{
  "id": "harness-hardening:subprocess-sandbox",
  "_kind": "HarnessHardeningGuidance",
  "_file": "security/harness-hardening/harness-hardening-guidance.yaml",
  "_cluster": "security",
  "attributes": {
    "displayName": "Subprocess sandbox policy guidance",
    "guidance": "Run agent subprocesses with workspace-write sandbox policy; deny network egress except to advertised tool servers.",
    "appliesTo": "agent-session",
    "severity": "recommended"
  },
  "outgoingEdges": [
    {
      "from": "harness-hardening:subprocess-sandbox",
      "to": "topic:agent-session-management",
      "kind": "hardening_guidance_applies_to"
    }
  ],
  "incomingEdges": []
}