# Agent sandboxes with governed data access: plan the boundaries

AgentBay provides isolated code and tool sandboxes with data access through LakeGate. Define what an agent may read, execute and change before giving it a real workflow.

## Relevant capabilities

- Isolated sandboxes for agent code and tools
- Scoped data access through LakeGate
- MCP access alongside existing agent toolkits

## How to compare

- Which actions need approval or must be prohibited?
- How are network, filesystem and data permissions separated?
- How will your team investigate an incorrect action?

## Bring these inputs

- One agent workflow and its tools
- Allowed data and action matrix
- Identity, logging and approval requirements

## A practical first workflow

- Choose a reversible task with explicit action limits.
- Connect only the required tools and scoped data access.
- Test failures and prohibited actions before expanding the agent’s remit.

## Check before expanding

- Attempt disallowed queries and actions.
- Check sandbox isolation and cleanup.
- Trace outputs to the originating workflow and permission set.

## Economics
Compare the cloud bill, platform charges, operating effort and migration work for the same workload. Cloud capacity is not free. Charges and scope need agreement before paid deployment.

## Switching considerations
AWS and Google Cloud are available today; other deployment environments are roadmap. Preserve the existing workload and access path until compatibility, recovery and cutover checks pass.

## Free next step
Get a free deployment checklist, then create your workspace. Free expert help with your use case is also available through our contact form.

[Create your HyperLake workspace](https://app.hyperlake.cloud/users/sign_in?intent=governed-agent-sandboxes&offer_id=starter-checklist-v1&utm_source=hyperlake&utm_medium=owned&utm_campaign=signup-journey&utm_content=landing_hero)

[Download the free checklist](https://hyperlake.cloud/solutions/governed-agent-sandboxes.txt)

No free cloud capacity is promised. Deployment scope and charges are agreed separately; AWS and Google Cloud are available today.

## Sources
- https://hyperlake.cloud/stacks
- https://hyperlake.cloud/faq
- https://hyperlake.cloud/get-started

[Discuss this workload](https://hyperlake.cloud/contact)