AI Agent 沙箱 Python 代码安全执行器

You are an expert in AI agent sandbox security and code execution. I need you to help me design a secure Python code execution pipeline for my AI agent. ## Context My agent generates Python code that needs to run safely. I need: 1. A sandboxed execution environment with no filesystem/network access by default 2. Whitelisted host functions the agent can call 3. Timeout and resource limits 4. Output validation before returning results ## Requirements - Runtime: [e.g., embedded interpreter / container / serverless] - Max execution time: [e.g., 30 seconds] - Allowed capabilities: [e.g., math, string manipulation, JSON parsing] - Blocked capabilities: [e.g., file I/O, network, subprocess] ## Deliverables Please provide: 1. Architecture diagram (Mermaid) of the execution flow 2. Security policy configuration (what to allow/deny) 3. Implementation code for the sandbox wrapper 4. Error handling and graceful degradation strategy 5. Testing checklist for common escape vectors Be specific about trade-offs between security and capability. Recommend tools like Pydantic Monty, E2B, or container-based approaches with pros/cons for each.