How to Evaluate AI Agent Containment Before Production
This is one possible evaluation approach for teams designing agentic systems. It is an idea for structuring scenarios and evidence, not a universal containment test or certification method.
An agent should not be considered contained because a design document says it is sandboxed. Containment should be evaluated against the paths, tools and data the agent can actually reach.
iSecureByDesign does not perform the containment threat model or independently certify that an agent is safe. The team defines the scenarios and expected controls; the tool can apply policy to the structured architecture, generate evaluation requirements, and help compare outputs with those expectations.
A useful evaluation plan includes:
- attempts to access disallowed files
- attempts to reach denied network destinations
- package and dependency substitution scenarios
- exposed or incorrectly scoped credentials
- tool calls outside the approved allowlist
- prompt or task changes that encourage boundary crossing
- logging, alerting, stop and recovery behavior
The evaluation should define expected outcomes before the test begins. “The agent failed to escape” is not enough if the system did not record what it attempted or if a different path was never tested.
How iSecureByDesign could help
Users can model the intended environment, configure controls, generate requirements and define evaluation expectations alongside the design. The Evaluation stage can then be used to assess generated or supplied outputs against those expectations.
This does not provide a universal containment benchmark or guarantee that future agent behavior is safe. It helps create a traceable evaluation plan tied to the architecture and policies that were selected.
The approach also reflects a lesson from recent frontier-model testing: monitoring and intervention need to operate during the run, not only after an incident is discovered. OpenAI has described adding stronger containment, monitoring and access controls after its evaluation incident, while Anthropic describes layered environment controls for its products.
See Secure-by-Design Requirements for AI-Generated Code for the related requirements and evaluation workflow.
Related Reading
About Agentic Thoughts: This Agentic Thought was generated with AI. Agentic Thoughts are part of an ongoing process of evolving ideas about iSecureByDesign and how it may be applied to real-world problems. They are exploratory and do not necessarily represent a final product commitment, implementation, or formal advice.