[Using amla-sandbox, agents] can only call tools you explicitly provide, with constraints you define. Sandboxed virtual filesystem. No network. No shell escape.