Sandboxing Agents Is a Three-Body Problem: Ankit Agrawal at [un]prompted II

Fix one sandbox boundary and you move the other two. That is the claim behind Ankit Agrawal's talk at [un]prompted II, also typed "unprompted II", the AI security practitioner conference in San Francisco on 27-29 October 2026. Our conference guide lists every session.

Ankit Agrawal of Webflow speaks on Day 1, Stage 2, at 13:30, according to the official agenda as published on 2026-10-12. The title is "Sandboxing Agents is a Three-Body Problem: Containment, Provenance, and the Human Authority". This is a preview written from the published abstract, before the talk. We are independent coverage, not the organiser, and we follow remotely. The agenda can change.

What the talk says it will show at [un]prompted II

The abstract says agent sandboxing is three coupled problems: containment, provenance and authority. It then promises two things: how Webflow sequenced its boundaries, and what approval telemetry showed in its research preview. The abstract does not give numbers or name the boundaries. We do not guess them.

Why this is the hard part

Most sandbox writing treats containment as the whole job: a process, a filesystem and a network policy. Our own isolation architecture for agent tool calls starts there too. The three-body framing says that is not enough, and we think it is right to say so. These are our inferences.

• Containment without provenance tells you what the agent could touch, not whose instruction it followed.
• Provenance without authority records that an untrusted page steered the agent, but nobody decides what to do about it.
• Authority without containment gives a human an approval button on an agent that can already reach everything.

The coupling is the point. Tighten containment and you create more approval requests. More approvals produce more reflexive clicks, which weakens authority. That is why we see this talk as a counterpart to the permission-fatigue session by Sahana Chennabasappa and Chris Puderbaugh on Day 2, Stage 2, at 13:55. Both sit in the six arguments we are tracking, and the people are in our speakers list.

The phrase three-body problem is a physics joke with a real point: three bodies that pull on each other have no tidy closed-form solution, and you cannot reason about one without the others. Applied here, the claim is that a team cannot design containment, then provenance, then authority as three separate projects. We see a practical consequence. A sequencing decision is a risk decision, because whichever boundary you build first is the one that protects you alone for the longest time. Webflow's order is therefore the most useful thing the abstract promises. We would also like to see how the order changed once the approval telemetry arrived. That is our wish list, not a claim about the talk.

What we will be watching for

• Which of the three boundaries Webflow built first, and the reason given.
• Whether the approval telemetry shows approvals that were fast, uniform or rarely refused.
• Whether provenance is a label on data, a taint that follows data, or a log kept afterwards.
• Whether the research preview used real customers or internal users, which changes how far the telemetry generalises.

If this holds, what changes on Monday

Our inferences, conditional on the talk. Write down your three boundaries for each agent and mark which ones exist today. Check what each change to one does to the others before you ship it. Log every approval with its time-to-click, so you can see whether your humans read what they approve. Our guidance on human oversight in production covers the governance side.

Three questions for Ankit Agrawal

These are the questions we would ask. The page stands without any reply.

1. What did the approval telemetry show about how people actually click: how fast, how often they refused, and did it change over time?
2. Which boundary did Webflow build first, and why that one?
3. With the research preview behind you, what would you sequence differently?