platform
features
notes from inside the boundary.
Agent sandboxes need a secret-aware network boundary that keeps real credentials host-side and decides per request.