Your agent sandbox isolates it. It does not govern it — and two of your rules cannot exist in a sandbox.

Isolation decides what an agent can reach. It says nothing about what the agent may do once it gets there. The rules most teams actually need — cumulative limits and \"only after X, deny Y\" — need a policy layer, not a tighter container.