Learn how a Docker sandbox, egress proxy, and defense-in-depth architecture limit the blast radius when AI agent guardrails inevitably fail.