AI Agents Are Shipping Code While You Sleep: A Developer's Field Guide to Sandboxing, Reviewing, and Auto-Approving Autonomous Code

┌─────────────┐
│  AI Agent   │  ← runs inside Docker container
└──────┬──────┘
       │ produces patch / branch
       ▼
┌─────────────────────┐
│  Sandboxed Env      │  ← fresh container, no secrets, network restricted
└──────────┬──────────┘
           │
           ▼
┌─────────────────────┐
│  CI Review Gates    │  ← lint, type-check, test, security scan, diff analysis
└──────────┬──────────┘
           │
           ▼
┌─────────────────────┐
│  Policy Engine      │  ← deterministic rules: auto-approve / reject / escalate
└──────────┬──────────┘
           │
           ├── auto-approve → merge
           ├── reject      → close PR
           └── escalate    → human review

# sandbox/Dockerfile
FROM node:20-alpine

# Non-root user for safety
RUN addgroup -S agent && adduser -S agent -G agent
USER agent

WORKDIR /workspace

# Install git, curl, and basic tooling
RUN apk add --no-cache git curl jq

# Copy the repo (mounted at runtime)
COPY . /workspace

# Default command: keep alive for agent to work
CMD ["sleep", "infinity"]

# sandbox/docker-compose.yml
services:
  agent:
    build: .
    user: "agent"
    working_dir: /workspace
    volumes:
      - ../:/workspace
    # No host network — use a bridge network only
    networks:
      - sandbox-net
    # Resource caps
    mem_limit: 2g
    cpus: "1.5"
    pids_limit: 256
    # Read-only root filesystem except /workspace
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

networks:
  sandbox-net:
    driver: bridge
    internal: true  # no internet access by default

# Build the sandbox image
docker build -t agent-sandbox ./sandbox

# Run the agent with a mounted repo and a restricted network
docker run --rm \
  --network sandbox-net \
  --cap-drop ALL \
  --security-opt no-new-privileges:true \
  --read-only \
  --tmpfs /tmp \
  --memory 2g \
  --cpus 1.5 \
  -v $(pwd):/workspace \
  agent-sandbox \
  sh -c "cd /workspace && agent-cli run --task '$TICKET' --output patch.diff"

# .github/workflows/agent-review.yml
name: Agent Review Gates

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    # Only run for branches created by the agent
    if: startsWith(github.head_ref, 'agent/')
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint
        continue-on-error: true  # collect all signals, don't fail fast

      - name: Type-check
        run: npm run type-check
        continue-on-error: true

      - name: Run tests
        run: npm test -- --coverage
        continue-on-error: true

      - name: Security scan
        uses: aquasecurity/trivy-action@0.24.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'json'
          output: 'trivy-report.json'
        continue-on-error: true

      - name: Diff analysis
        id: diff
        run: |
          # Compute a JSON summary of the diff: files touched, lines changed,
          # new dependencies, deleted tests, etc.
          python scripts/analyze_diff.py --base origin/main --head HEAD > diff-summary.json

      - name: Emit review report
        run: |
          # Combine all signals into a single report for the policy engine
          python scripts/combine_report.py \
            --lint lint.json \
            --type typecheck.json \
            --test test-results.json \
            --trivy trivy-report.json \
            --diff diff-summary.json \
            --output /tmp/review-report.json

      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: review-report
          path: /tmp/review-report.json

# scripts/analyze_diff.py
import json
import subprocess
import sys
from pathlib import Path

BASE = sys.argv[1] if len(sys.argv) > 1 else "origin/main"
HEAD = sys.argv[2] if len(sys.argv) > 2 else "HEAD"

# Get the list of changed files
changed = subprocess.run(
    ["git", "diff", "--name-only", BASE, HEAD],
    capture_output=True, text=True
).stdout.strip().split("\n")

# Get the diff stat
stat = subprocess.run(
    ["git", "diff", "--numstat", BASE, HEAD],
    capture_output=True, text=True
).stdout.strip().split("\n")

files = []
for line in stat:
    if not line.strip():
        continue
    additions, deletions, path = line.split("\t")
    files.append({
        "path": path,
        "additions": int(additions),
        "deletions": int(deletions),
        "extension": Path(path).suffix
    })

# Flag suspicious patterns
suspicious = []
for f in files:
    if f["path"].endswith(".test.js") or f["path"].endswith(".spec.js"):
        # If test file is modified but no source file changed, it's suspicious
        # (agent may be rewriting tests to match its code)
        suspicious.append({"type": "test-only-change", "path": f["path"]})
    if f["additions"] + f["deletions"] > 500:
        suspicious.append({"type": "large-diff", "path": f["path"], "lines": f["additions"] + f["deletions"]})

# Check package.json for new dependencies
if "package.json" in changed:
    diff_pkg = subprocess.run(
        ["git", "diff", BASE, HEAD, "--", "package.json"],
        capture_output=True, text=True
    ).stdout
    if "+\"" in diff_pkg and "dependencies" in diff_pkg:
        suspicious.append({"type": "new-dependency", "path": "package.json"})

# Check for deleted tests
if any("deletions" > 0 and ("test" in f["path"] or "spec" in f["path"]) for f in files):
    suspicious.append({"type": "test-deletion", "path": "tests/"})

print(json.dumps({
    "changed_files": len(files),
    "total_additions": sum(f["additions"] for f in files),
    "total_deletions": sum(f["deletions"] for f in files),
    "suspicious": suspicious
}, indent=2))

# scripts/policy_engine.py
import json
import sys

def load_report(path):
    with open(path) as f:
        return json.load(f)

def evaluate(report):
    """
    Returns: {
        "decision": "approve" | "reject" | "escalate",
        "reasons": ["..."]
    }
    """
    reasons = []
    decision = "approve"

    # Rule 1: No security vulnerabilities
    if report.get("trivy", {}).get("high", 0) > 0:
        decision = "reject"
        reasons.append(f"Security scan found {report['trivy']['high']} high-severity vulnerabilities")

    # Rule 2: No test failures
    if report.get("test", {}).get("failed", 0) > 0:
        decision = "reject"
        reasons.append(f"Test suite failed: {report['test']['failed']} failures")

    # Rule 3: No suspicious diff patterns
    suspicious = report.get("diff", {}).get("suspicious", [])
    if any(s["type"] == "test-only-change" for s in suspicious):
        decision = "escalate"
        reasons.append("Test files changed without corresponding source changes — possible test manipulation")
    if any(s["type"] == "new-dependency" for s in suspicious):
        decision = "escalate"
        reasons.append("New dependency added — requires human review")

    # Rule 4: Large diffs always escalate
    if report.get("diff", {}).get("total_additions", 0) > 800:
        decision = "escalate"
        reasons.append(f"Large diff ({report['diff']['total_additions']} additions) — needs human review")

    # Rule 5: Lint errors only escalate if they're in non-test files
    if report.get("lint", {}).get("errors", 0) > 0:
        if decision == "approve":
            decision = "escalate"
        reasons.append(f"Lint errors: {report['lint']['errors']}")

    # Rule 6: Type errors are always fatal
    if report.get("type", {}).get("errors", 0) > 0:
        decision = "reject"
        reasons.append(f"Type errors: {report['type']['errors']}")

    return {"decision": decision, "reasons": reasons}

if __name__ == "__main__":
    report = load_report(sys.argv[1])
    result = evaluate(report)
    print(json.dumps(result, indent=2))

# .github/workflows/agent-review.yml (continued)
      - name: Run policy engine
        id: policy
        run: |
          python scripts/policy_engine.py /tmp/review-report.json > /tmp/decision.json
          cat /tmp/decision.json

      - name: Auto-approve if safe
        if: steps.policy.outputs.decision == 'approve'
        run: |
          # Use GitHub CLI to approve and merge
          gh pr review ${{ github.event.pull_request.number }} --approve
          gh pr merge ${{ github.event.pull_request.number }} --squash --auto

      - name: Request human review if escalate
        if: steps.policy.outputs.decision == 'escalate'
        run: |
          gh pr review ${{ github.event.pull_request.number }} --request-reviewers "@your-org/reviewers"
          gh pr comment ${{ github.event.pull_request.number }} --body "⚠️ **Policy escalation** — this PR needs human review. Reasons: $(cat /tmp/decision.json | jq -r '.reasons | join("; ")')"

      - name: Close if reject
        if: steps.policy.outputs.decision == 'reject'
        run: |
          gh pr close ${{ github.event.pull_request.number }} --comment "❌ **Auto-rejected by policy engine** — $(cat /tmp/decision.json | jq -r '.reasons | join("; ")')"

# scripts/audit_logger.py
import json
import os
import time
from datetime import datetime, timezone

def log_decision(pr_number, decision, reasons, agent_info):
    """
    Writes a structured audit event to a log file.
    In production, ship this to your logging system (Datadog, CloudWatch, etc.)
    """
    event = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "pr_number": pr_number,
        "decision": decision,
        "reasons": reasons,
        "agent": agent_info,
        "commit_sha": os.environ.get("GITHUB_SHA", "unknown"),
    }
    with open("/var/log/agent-audit.jsonl", "a") as f:
        f.write(json.dumps(event) + "\n")
    print(json.dumps(event, indent=2))

# Add to policy_engine.py
CRITICAL_PATHS = ["auth/", "payments/", "migrations/", "terraform/", "k8s/"]

for f in report.get("diff", {}).get("files", []):
    if any(critical in f["path"] for critical in CRITICAL_PATHS):
        decision = "escalate"
        reasons.append(f"Critical path modified: {f['path']}")
        break