Tensions in Practice: Representative exercise in tension with a tight effect boundary¶
Candidate execution · disposable environment
A candidate program can run on disposable files with outside calls blocked. That reveals real local behavior while keeping remote effects out of the test. If the question concerns a remote interaction, however, blocking it also removes the behavior being investigated. Allowing one controlled test endpoint broadens what can be learned and enlarges the effect boundary that must be maintained.
Keep effects bounded
Prevent the candidate’s actions from reaching resources outside the declared test envelope.
Exercise the relevant behavior
Let the candidate perform the interaction the test is meant to illuminate.
Why these aims pull against each other
Removing a permission can remove both an unwanted effect and the behavior needed as evidence. Every permitted crossing must therefore have a defined scope and an observation plan.
Choose an arrangement to see what changes and what remains difficult.
Qualitative paths and conditions, not measured costs, timings or performance guarantees.
What this choice protects
What it costs
When it fits
Compare the arrangements
Exercise locally
Execute against disposable local files and deny network calls.
- What it protects
- Local effects remain inside a smaller envelope with fewer outside dependencies.
- What it costs
- The run cannot reveal the behavior of a successful remote interaction; a blocked call is not a test of that dependency.
- When it fits
- Fits local transformations or early investigation where remote behavior is not yet the question.
Illustration note: This is still execution, not merely quarantining dormant code. The illustration assumes an enforced perimeter and observable local effects.
Allow one controlled crossing
Permit interaction only with a named test endpoint, alongside the disposable files.
- What it protects
- The run can reveal behavior involving that selected dependency.
- What it costs
- The endpoint and its reachable effects must now be controlled, scoped, reset or otherwise accounted for, and observed. The containment argument is larger.
- When it fits
- Fits a question that genuinely requires the interaction and a test dependency whose full allowed effects can be kept within the envelope.
Illustration note: The endpoint is a hypothetical controlled test resource. No production access, general egress, or guarantee from the word sandbox is assumed.
What this illustration does—and does not—establish
Sandboxing: Exercise versus Protect (the load-bearing combination) supplies exercise versus containment; Sandboxing: In-Sandbox Evidence versus Out-of-Distribution Deployment (the graduation gap) bounds transfer of the evidence beyond the enclosure. The file and endpoint paths are editorial instantiations of declared permissions.
- Neither run certifies deployment suitability; protective differences from production can invalidate direct extrapolation.
- The illustrated allowed endpoint must not hide uncontrolled downstream effects. A name or network address alone is not a complete perimeter.
- An observation or successful run does not automatically promote the program.
Source entries
Sandboxing
Sandboxing: Exercise versus Protect (the load-bearing combination) supplies the conflict examined here.
Exercise versus Protect (the load-bearing combination)
A sandbox must do two things at once that pull apart: *exercise* the candidate (expose it to real conditions to learn what it does) and *bound* its consequences (keep failure from escaping).
In-Sandbox Evidence versus Out-of-Distribution Deployment (the graduation gap)
"it worked here" does not entail "it works there."
Core Idea
The defining moves are four: *build a perimeter* (a syscall filter, a virtualized filesystem, a fenced market, a delineated trial program); *specify the permissions* that may cross the perimeter in each direction; *run the candidate inside* with rich observability; and *commit in advance to non-promotion*, so that failure inside does not propagate outside and success inside does not automatically promote outside without an explicit graduation step.