# Write a threat model and score a shortlist

Lesson 1 of [Evaluate a sandbox provider before you commit](https://agentsandboxes.fyi/academy/evaluate-an-agent-sandbox-provider.md), 15 minutes.

Start with your workload, not with a provider. Write the threat model in six lines.

## The six lines

1. **Who writes the code that runs?** You, your users, or the model while it reads untrusted text.
2. **What can the code reach?** Files, network hosts, databases, other tenants.
3. **What is the worst outcome?** A data leak, data loss, a large bill, or an attack on someone else.
4. **How long does one run last?** Seconds, minutes or days.
5. **Must state survive?** Nothing, a snapshot, or a whole machine.
6. **Who are the users?** Only you, your team, or the public.

Line 1 sets the isolation that you need. Lines 4 and 5 set the persistence model. Line 6 tells you if tenants must be kept apart.

## Build the shortlist

Pick a category on this site: code execution, dev environments, browser sessions, computer use, evals and RL, or open source. Choose two or three providers whose isolation and persistence fit your threat model. Use the compare tool to put them side by side.

## Score each provider

Give each question a score: 0 (no, or not stated), 1 (partly) or 2 (yes). Add the scores.

- Is the isolation type stated in the docs?
- Can you turn the network off, or filter it by host?
- Can you set time, CPU, memory and disk limits for each run?
- Does the state model fit lines 4 and 5?
- Can you delete a sandbox and export its log?
- Can you leave? Look for open source, self-hosting or a standard image format.

Record the source URL and the date for each score. A feature that is not stated gets 0 until the vendor confirms it in writing. If two providers have the same total, compare cost. Lesson 2 shows how.

## Sources

- AgentSandboxes guide: How to compare sandbox providers
- AgentSandboxes, sandbox provider categories (taxonomy)

Also on the [web page](https://agentsandboxes.fyi/academy/evaluate-an-agent-sandbox-provider/threat-model-and-shortlist).