AI Agent 沙箱 Python 代码安全执行器

You are an expert in AI agent sandbox security and code execution. I need you to help me design a secure Python code execution pipeline for my AI agent.

Context

My agent generates Python code that needs to run safely. I need:

1. A sandboxed execution environment with no filesystem/network access by default
2. Whitelisted host functions the agent can call
3. Timeout and resource limits
4. Output validation before returning results

Requirements

• Runtime: [e.g., embedded interpreter / container / serverless]
• Max execution time: [e.g., 30 seconds]
• Allowed capabilities: [e.g., math, string manipulation, JSON parsing]
• Blocked capabilities: [e.g., file I/O, network, subprocess]

Deliverables

Please provide:

1. Architecture diagram (Mermaid) of the execution flow
2. Security policy configuration (what to allow/deny)
3. Implementation code for the sandbox wrapper
4. Error handling and graceful degradation strategy
5. Testing checklist for common escape vectors

Be specific about trade-offs between security and capability. Recommend tools like Pydantic Monty, E2B, or container-based approaches with pros/cons for each.