Agent Sandbox Containment Workflow
Layer 1 of the agent containment stack: every tool call executes in an ephemeral container, and any path outside the workspace is denied and logged as a security event.
Permission Gate Containment Workflow
Layer 2 of the agent containment stack: a permission gate checks the whitelist and path scope before execution, and aborts the call with a logged denial when the scope does not match.
Full FlowZap Code
Copy and paste the following FlowZap code into a project in your FlowZap account to see this template diagram.
agent { # Agent
n1: circle label:"Tool Call Initiated"
n2: rectangle label:"Request File Write"
n5: diamond label:"Permission Granted?"
n6: rectangle label:"Write File to Disk"
n7: rectangle label:"Abort - Log Denial"
n8: circle label:"Done"
n1.handle(right) -> n2.handle(left)
n2.handle(bottom) -> permgate.n3.handle(top) [label="check permission"]
}
permgate { # Permission Gate
n3: rectangle label:"Check Whitelist and Path Scope"
n4: rectangle label:"Return Decision"
n3.handle(right) -> n4.handle(left)
n4.handle(top) -> agent.n5.handle(bottom) [label="decision"]
n5.handle(right) -> n6.handle(left) [label="granted"]
n5.handle(bottom) -> n7.handle(top) [label="denied"]
n6.handle(right) -> n8.handle(left)
n7.handle(right) -> n8.handle(left)
}
Install the MCP packagenpm install -g flowzap-mcpMCP documentation
Related templates
Four-Layer Agent Containment Stack
The full containment stack in one diagram: sandbox, permission gate, HITL approval and SIEM audit applied in sequence around a single dangerous tool call.
HITL Approval Containment Workflow
Layer 3 of the agent containment stack: dangerous tool calls are suspended and sent to a human reviewer, who approves or aborts the operation before anything executes.
Audit Logging & SIEM Containment Workflow
Layer 4 of the agent containment stack: arguments are sanitized, secrets stripped and the action trace written to the SIEM before execution continues.
Patch Closure Proof Workflow
Closing-proof workflow across detection, remediation and assurance: measure the fix rather than the reaction, rate the outage risk and refuse closure without evidence.
Artifact Provenance Verification Workflow
Build, provenance and registry lanes: an artifact is only accepted when its attestation matches the build that produced it, and a hijacked repo sends it back to build.