TrustShell · defense in depth
Sandbox, Guardrail, Harness
Why you need all three.
A sandbox limits where the agent can reach. A guardrail limits what it is allowed to try. A harness is the record of who owns it, what it did, and who can stop it. One of them is not enough — each is blind to exactly what the others catch. The hybrid is all three, with the harness as the part that travels.
Three controls, three jobs
Sandbox
limits WHERE
A room. It fences off the files, the network and the money an agent can reach.
Strength The model cannot argue its way past a wall. A prompt injection that succeeds still cannot read a disallowed path.
Weakness The room does not travel. A sandbox that permits a package cache has a door; it does nothing for a claim stated in chat, and it never tells a buyer who is responsible.
Pattern: Claude Code's bubblewrap / seatbelt; CrowdStrike runs each harness in its own VM with syscall filters.
Guardrail
limits WHAT
A rule the agent cannot edit: a typed schema, a payee list, a two-family check, an amount.
Strength Specific, not vague — this tool, this host, this amount. The limit is named, not hoped for.
Weakness A prompt is not a control. If the only thing stopping a spend is a sentence in the system prompt, a jailbreak walks straight through it. Authorize the session, not the binary.
Pattern: an egress allowlist (Arcjet), and a spend permission the account itself enforces (Coinbase spend permissions / ERC-7715).
Harness
limits by RECORD
The owner, the grant, and the receipt — who owns the agent, what it did, and who can stop it.
Strength Portability, and a person at the root. The agent can change models; the limits stay, and they travel with it.
Weakness A harness without a room still has a leaked key. A harness without a check still has a confident lie. A label that says "harness" and does not enforce the grant is a sandbox with worse marketing.
This is the part TrustShell carries between surfaces — the ERC-8004 passport and the signed receipt that outlive any one runtime.
The hybrid, in the order a request moves
Each layer sits where it can refuse before the next one runs, so no single control is asked to do a job it is bad at.
- 1
The specialist runs in a room
SandboxRoadmap, not shipped: its files and network are the ones named on its belt. A tool call to any other host is refused before the model ever sees a result — the wall is upstream of the answer, not a reaction to it.
- 2
The PAI holds a session, not the wallet
GuardrailThe grant names an amount, a payee, an expiry and a purpose. Anything outside it is rejected. Lowering the cap and pulling the grant happen now; raising the cap, adding a payee, or a transfer wait 24 hours and can be cancelled. A leaked key stops at the cap.
The guardrail that is not a wish. Today the engine enforces the session; before mainnet the on-chain backstop — an ERC-7715-style session key, where the account itself enforces the caveat — makes the same limit hold without us. The stake that backs a ceiling is simulated testnet USDC until a real escrow is funded: a testnet stake shows in the figure, but it does not raise what the agent may actually spend.
- 3
The stamp runs on the claim
CheckTwo model families agree, or it is Not checked — and a miss is not a pass. A 2-of-3 is a majority, not a truth: it may set the label, but it moves no score (a check on this site writes nothing to one) and it does not unlock a spend, a post, or a higher cap. The person still breaks the tie on money and health.
The router (ANFIS) routes; it does not grade. A local classifier (Laya) will take the first pass once it beats the current scrubber; until then it gates nothing. The stamp is the trust state you see on /check: Checks out, Caught, or Not checked.
- 4
Autonomy is earned inside a ceiling the person already signed
HarnessRoadmap, not shipped: roughly 14 days and 20 actions with no "Caught" can restore a band the owner granted — it cannot raise the cap. A Caught, an off-list payee, or a dispute drops the band and asks the person. A rented agent gets the session, not the key, the memory, or root: the owner revokes, and everything under that session stops.
What the blast radius looks like
The point of three layers is that a failure in one is contained by the others. The agent acts; the person remains the one who can widen the room.
See a layer work
The check is the one you can run right now with nothing installed. The rest of the journey — claim, fund, stake, spend — runs on the test network, so you can watch the guardrail refuse without risking anything.
Everything past the check runs on Base Sepolia testnet — the money is practice money with no value, and the on-chain spend path and escrow are still being wired. The design is described here honestly, not claimed as finished.
Go deeper