Three Jobs, Not One: Why "Sandboxing" Cannot Contain Foreign Code or Witness Its Own Execution

Agentic AI systems routinely execute code their operators did not write, and the field answers with a single word: sandboxing. That word conflates three jobs with different trust structures. Deciding what may be attempted is a policy problem. Containing foreign code requires a boundary the code does not control. Producing execution evidence requires an observer outside the thing observed. The application framework that performs the first job cannot in general discharge the second and third. Containment fails on shared trust surfaces, and evidence fails on identity wherever the producing component sits inside the trust domain its record describes. A curated corpus of nine public 2025-2026 incidents grounds the separation; seven are failures of the second job. Architectures that can produce execution evidence are sorted into five classes on three axes: observer position, signing-key custody and vantage scope. Those five classes rest on four trust roots. Two degrees of independence grade them: a record the workload cannot forge, and one that additionally survives an operator free to withhold the runs that embarrass it. Over arbitrary runtime behavior across a complete run set, the second degree is filled by no construction surveyed here. The closest constructions, cryptographic traces for mobile agents [@vigna1998cryptographic] and accountable virtual machines [@haeberlen2010accountable], reach it only over network-input behavior, replaying known code against a reference; a registry-installed workload supplies neither; part of the residual is obstructed, not merely unbuilt. The discipline that follows is coverage-bounded honesty. A signed PASS says that no violation was observed in this run, under this test set, at this boundary, on this date. It never says the code is safe. Recommendations to the OWASP Agentic Security Initiative follow from that discipline, with seven questions a buyer can put to any vendor claiming sandboxing.