Anthropic provides
Isolation is a spectrum, chosen against a threat model. Claude Code alone spans a per-command Bash sandbox, a whole-process sandbox runtime, dev containers, custom containers, and full VMs — each isolating more, at more setup cost. Managed Agents add secure sandboxing with credentials in scoped vaults, and self-hosted sandboxes with MCP tunnels for on-prem.
Two controls do the heavy lifting. Network egress is a default-deny allowlist — the sandbox reaches only the domains you name. And credentials are held outside the sandbox by a proxy that issues scoped, short-lived access inside it, so the secret itself never enters the box the agent runs in.
The docs are blunt about the limit: isolation reduces the blast radius of a breach, it does not eliminate it. Any egress path can still leak what the agent can read; any writable mount can still be changed. Isolation is defense in depth, not a hard guarantee — and it matters most under --dangerously-skip-permissions or unattended auto mode, exactly when no human is prompted.
Skoor adds
The sandbox decides what an agent can reach; Skoor records and scores whether it stayed inside that boundary — and neither requires trusting Skoor with anything. The controls attach to the same primitives above.
The egress allowlist is a governance scope by another name: the certified profile names the domains, and a domain reached outside the list is a drift event, not a mystery. The credential proxy is the custody map made concrete — because the secret never enters the box, Skoor never needs it either, which is precisely why Skoor is not a subprocessor you must disclose. And the isolation tier itself is a scored posture input: an unattended run under --dangerously-skip-permissions without a real boundary is a finding, and the assessment says so.
The moment a scorer sits inside your data path, the score stops being independent — so Skoor stays outside every tier, reading the record the sandbox and the audit sink already produce.
Where Skoor converges
Nothing new is invented at this edge. Each control lands on a primitive the loop already has — which is why it can be enforced and measured rather than merely promised.
Stated plainly
The sandbox is Anthropic's boundary; the custody map is Skoor's. Isolation is defense in depth, never a hard guarantee — Skoor measures whether the boundary you chose matches the risk you are running, and never claims the boundary is stronger than the docs say it is.
The assessment establishes what your agents can reach at every edge — and produces your baseline Company Skoor.