AI Agent Sandboxing Is Not Optional Once It Touches Production Data

A client wanted an agent that could update records in their production database based on natural language requests from internal staff. The pitch was reasonable on its surface — fewer manual data-entry tickets, faster turnaround. The implementation plan, as first proposed, had the agent executing generated SQL directly against the production database with the same permissions as the team's own admin tooling. I stopped the project there.

'The model is usually right' isn't a safety boundary

An agent that's correct 98% of the time and has unrestricted write access to production is not a 98%-safe system. It's a system that will, with certainty, eventually execute a wrong write against real data, and the cost of that one wrong write in a database with no sandbox is whatever that data point was worth to the business — which is sometimes trivial and sometimes catastrophic, and you don't get to pick which case shows up.

A high success rate describes how often an agent is right. It says nothing about what happens the time it's wrong.

What sandboxing actually looked like once we built it properly

• The agent generates a proposed change against a staging replica, never production directly.
• A validation layer checks the proposed change against business rules (row count limits, field-level constraints, blocked tables) before anything executes.
• Changes above a risk threshold require human approval, surfaced as a plain-language diff, not raw SQL nobody will actually read.
• Every executed change is logged with the full agent reasoning trace attached, so a bad change is traceable back to the prompt and context that caused it.

The sandbox is the feature, not the tax on the feature

The client's first reaction was that this added friction to what should have been a simple automation. It did add friction. It also meant that when the agent, a few weeks later, misread an ambiguous request and proposed deleting records it shouldn't have, the validation layer caught it before anything happened, and the only outcome was a failed proposal in a log, not an incident. That's the entire value proposition of sandboxing in one sentence: it turns a production incident into a boring log entry.