What Each Approach
Actually Covers
Sandboxes, gateways, and cloud guardrails each protect part of the agent threat surface. None covers all of it. Here's what you're actually getting.
Sandboxes contain code execution but can't govern agent actions. AI gateways govern network traffic but miss local operations. Cloud guardrails filter model I/O but don't control what agents do with the response. Jozu Agent Guard covers the full lifecycle: artifact verification before execution, policy enforcement during execution, and tamper-evident auditing after execution.
Every agent security product
falls into one of three categories.
The differences matter because each one protects against a different class of threat while leaving others unaddressed.
Contain the execution. Can't govern the actions.
Docker Desktop Sandboxes, E2B, Daytona, Northflank, Modal
What sandboxes protect against
Sandboxes are strong at containing code execution risk. Docker Desktop uses microVM isolation to give each coding agent its own kernel, daemon, and filesystem boundary. E2B uses Firecracker microVMs, the same technology behind AWS Lambda. All prevent an agent from directly accessing host OS resources, and most provide network egress control and resource limits.
Docker extends beyond pure sandboxing with an MCP Catalog of 200+ curated MCP servers scanned for exploits and malicious behavior, plus a partnership with E2B for cloud-based sandboxing.
What sandboxes cannot protect against
Sandboxes constrain where code runs. They do not govern what actions the agent takes. An agent inside a Docker Sandbox can still make arbitrary API calls to any allowed endpoint. It can still invoke MCP tools in ways that violate your organization's policies. The sandbox has no opinion about whether a particular tool call is appropriate.
No sandbox vendor provides supply chain verification for AI artifacts, tamper-evident audit trails for compliance, disconnected or air-gapped governance, content guardrails on inference I/O, or human-in-the-loop approval for high-risk actions.
Govern the network path. Blind to local actions.
Runlayer, Solo.io Agent Gateway, MCP-specific gateway products
What gateways protect against
Gateways are strong at governing MCP traffic and providing visibility into agent-to-tool interactions. Runlayer offers centralized catalogs of pre-vetted MCP servers with approval workflows, SSO/SCIM integration, multi-tier threat detection, and PII/token masking. Solo.io builds a purpose-built data plane for agentic protocols with authn/authz, mTLS, tool-level RBAC, and Kubernetes integration.
What gateways cannot protect against
Actions that don't cross a network boundary are invisible. Stdio-based MCP servers, local file operations, and shell commands all bypass a gateway entirely. When an AI coding agent runs rm -rf on the local filesystem or kills a process, no network gateway sees it happen.
No gateway vendor provides supply chain verification, cryptographic attestation, or artifact signing. Both architectures depend on a centralized control plane — if unreachable, policy enforcement stops. Neither provides hypervisor-level runtime isolation or tamper-evident, cryptographically chained audit logs.
Filter model I/O. Can't control agent behavior.
AWS Bedrock Guardrails, Azure AI Studio, Google Vertex AI Safety
What cloud guardrails protect against
Cloud guardrails are strong at inference I/O content safety. AWS Bedrock provides content filtering for hate speech, PII redaction, toxicity, and prompt injection defense, plus automated reasoning checks for hallucination detection. Strong model access control through IAM with role-based permissions and ephemeral credentials.
What cloud guardrails cannot protect against
Cloud guardrails filter model inputs and outputs. They do not govern what the agent does with a model's response. An agent can receive a perfectly safe response from Bedrock and then execute a destructive shell command. The guardrail never sees the action — only the inference call.
Cloud guardrails cannot govern agents running on-premises, at the edge, on developer desktops, or in air-gapped environments. No cloud vendor provides supply chain verification, cryptographic signing of model artifacts, MCP-specific governance, or human-in-the-loop approval for high-risk agent actions.
The structural gap: Sandboxes govern where agents run. Gateways govern what crosses the network. Cloud guardrails govern model I/O. None governs the full lifecycle — from artifact verification through runtime enforcement to tamper-evident auditing.
Full lifecycle. One runtime. No gaps.
Agent Guard is a zero-trust AI runtime that enforces governance across the full lifecycle: verifying artifacts before they execute, enforcing policies on every action during execution, and maintaining tamper-evident audit trails after execution.
Artifact Verification
Five integrated scanners covering 10+ vulnerability types. Cosign signatures, OCI referrer attestations, and SHA-256 digests on every component. ArtifactPolicy gates deployment.
Tool Governance
ToolPolicy enforces per-agent, per-user, per-tool granularity on every MCP tool invocation. Argument validation, destructive operation blocking, rate limiting. Fail-closed by design.
Human Approval
High-risk actions trigger human confirmation via MCP's elicitation protocol. Destructive operations, financial transactions, and sensitive data access require approval before execution.
Immutable Auditing
Cryptographically chained audit logs that maintain integrity even when disconnected. Every policy decision is logged with full context. Compliance-ready for regulated environments.
Local Enforcement
Policies are OCI artifacts distributed through existing registries and enforced locally. No runtime dependency on any central controller. Full governance on laptops, edge devices, and air-gapped networks.
Hypervisor Isolation
For the highest-assurance environments, Agent Guard executes workloads inside hypervisor-isolated containers where only supply-chain-verified artifacts are admitted.
Capability Matrix
| Capability | Sandboxes | AI Gateways | Cloud Guardrails | Jozu Agent Guard |
|---|---|---|---|---|
| Supply chain scanning | ✓ 5 scanners, 10+ vulnerability types | |||
| Cryptographic signing & attestation | ✓ Cosign, OCI referrers, SHA-256 | |||
| Artifact diffing | ✓ | |||
| Model registry | ◉ Vendor-specific | ✓ OCI-standard, portable | ||
| SBOM generation | ✓ SPDX 3 | |||
| Hypervisor isolation | ✓ Docker, E2B | ✓ | ||
| Tool-level access control | ✓ Runlayer, Solo.io | ✓ | ||
| Content guardrails | ◉ Runlayer PII | ✓ | ✓ | |
| MCP threat detection | ◉ Docker catalog | ✓ Runlayer, Solo.io | ✓ | |
| Human-in-the-loop | ✓ | |||
| Disconnected / air-gapped | ✓ | |||
| Tamper-evident audit | ✓ | |||
| Admission-time artifact policy | ✓ | |||
| Production Kubernetes | ✓ Solo.io | ✓ | ✓ | |
| Desktop and edge governance | ◉ Docker | ◉ Runlayer | ✓ |
Three Questions Worth Asking
When evaluating any agent security solution, the coverage gaps matter more than the coverage claims.
What happens on the local machine?
If your agent governance only sees network traffic, everything the agent does locally — file operations, shell commands, process management — is ungoverned. This is where sandboxes help but gateways and cloud guardrails do not.
What happens before execution?
If you can govern what the agent does but not verify what the agent is, you have a runtime problem without a supply chain solution. No sandbox, gateway, or cloud guardrail today provides cryptographic verification that the artifact running in your environment is the same one your team approved.
What happens when the network is down?
If your governance depends on a centralized control plane, disconnected environments are ungoverned by definition. For organizations operating in air-gapped, edge, or intermittently connected environments, this is not a theoretical concern.
Close the Gaps in
Your Agent Security
Agent Guard was designed to close the structural gaps that sandboxes, gateways, and cloud guardrails leave open.