---
title: "What is a sandbox?"
description: "A sandbox is a financial virtual machine for an AI agent. A funded Solana wallet, rules you sign, a scoped view of the chain and a record of everything the agent did."
editUrl: true
head: []
template: "doc"
sidebar: {"hidden":false,"attrs":{}}
pagefind: true
draft: false
---

> For the complete documentation index optimized for AI agents, see [llms.txt](https://docs.arete.run/llms.txt) or [llms-full.txt](https://docs.arete.run/llms-full.txt). A markdown version of this page is available at [/sandboxes/overview.md](https://docs.arete.run/sandboxes/overview.md) or by sending `Accept: text/markdown`.
:::caution[Alpha]
Sandboxes are in public alpha. They hold real SOL and tokens. Fund a sandbox
only with what you are prepared to lose, and expect the rules format, the API
and these docs to change.
:::

A sandbox is a hosted Solana wallet that an agent can use but never holds the
key to. Think of it as a financial virtual machine: the agent runs inside it,
can do anything the machine allows, and nothing it doesn't.

You, the owner, create the sandbox, fund it, decide which programs it may use
and sign those rules once. The agent asks Arete to run actions. Arete builds
each transaction, checks it against your rules, signs it and sends it.

## The four parts

| Part        | What it is                                                                                                    |
| ----------- | ------------------------------------------------------------------------------------------------------------- |
| **Wallet**  | A Solana wallet Arete holds the key for. You fund it; the agent spends from it.                               |
| **Rules**   | A document you sign: the programs the agent may use, their instructions, spend limits and where funds may go. |
| **Reads**   | What the agent can see: the sandbox's state, plus program reads and live views for the programs in its rules. |
| **History** | Every action the agent asked for, landed or refused, with decoded instructions, events and balance changes.   |

## The boundary is the wallet

Whatever you send into the sandbox is the agent's to use within the rules: it
may trade it, and it may lose it. The rules make sure the agent uses only the
programs you turned on, in the ways they allow, and that funds cannot leave to
anywhere you cannot recover them from.

The rules do not judge whether a trade is a good one. Price, slippage within
what you allowed and losses are the agent's to manage. See the
[security model](/sandboxes/security/) for exactly what is and isn't enforced.

## One set of rules for writes and reads

Most agent wallets only guard what an agent can _send_. A sandbox's rules
also decide what it can _see_. The programs in the rules are the programs the
agent can call, and also the programs whose accounts it can read and whose
live views it can follow through Arete. An agent can't act on a program that
isn't in the sandbox, and it can't read one through Arete either.

That keeps an agent focused on the venues you chose, and stops it from
wandering into protocols you never meant it to touch.

:::note[What applies today]
Writes are scoped, and so are program reads and live views read through the
sandbox. General chain reads are not scoped yet; see
[Read scope](/sandboxes/read-scope/).
:::

## Who does what

| You, the owner                                | Your agent                                          |
| --------------------------------------------- | --------------------------------------------------- |
| Create and fund the sandbox                   | Reads its status, rules, holdings and history       |
| Choose programs, limits and allowed addresses | Previews an action to see whether it passes         |
| Sign the rules                                | Runs actions: program instructions, withdraws       |
| Grant agents access and choose their actions  | Corrects a refused request from its `code` and hint |
| Pause the sandbox or revoke an agent's access | Never sees a key, a transaction to sign or an RPC   |

Owner operations (rules, grants, pause, revoke) happen on the
[Sandboxes page](https://app.arete.run/dashboard/sandboxes) of the dashboard.
No agent tool can reach them.

## Next

- [Quickstart: your first sandbox](/sandboxes/quickstart/)
- [How a request flows](/sandboxes/how-it-works/)
- [Use cases](/sandboxes/use-cases/)