Question: is there a supported way to constrain what generated code can access at execution time?

### Duplicates

- [x] I have searched the existing issues

### Summary 💡

Working on the execution side of agent-generated code and trying to understand AutoGPT's current model before I go further.

When an agent generates and runs code, what's the supported way today to constrain what that code can touch on the host; filesystem, network, environment? Looking through the execution path I can see the sandboxing options, but I want to understand what's considered the recommended boundary rather than inferring it.

Asking because I've been building a runtime aimed at that problem: one file that runs natively on Mac, Windows and Linux with zero permissions until explicitly granted, returning structured denials an agent can parse and adapt to rather than a generic failure. There's an MCP server in it, so an AutoGPT agent could be pointed at it as an execution target today. Repo is `https://github.com/incyashraj/krate`.

Two questions, either one is useful:

1. What's the intended execution boundary for generated code in AutoGPT right now?
2. If someone wanted to plug in an alternative execution target, what interface would it need to satisfy?

Happy to do the integration work myself if the second one has an answer.

### Examples 🌈

_No response_

### Motivation 🔦

_No response_

Review AutoGPT's execution path and existing sandboxing options, then compare them with the proposed alternative execution target. A useful resolution would document the supported host-access boundary and the interface an alternative target must satisfy.

Written by the indexing model from the issue text.