---
kind: task
slug: agent-builder-review-sandbox
title: Review, test, and activate agent drafts
plan_slug: workspace-communications
epic_slug: agent-participation
status: ready
priority: P1
tenant_id: global
owner: unassigned
cursor_todo_id: null
updated_at: "2026-10-22"
---

# Task summary

Add permission review, constrained sandbox testing, and explicit publish/activate flows for generated or manually edited agent drafts.

## Description

Turn a private draft into a trusted workspace agent through a structured review of instructions, requested tools, context/channel access, model role, harness route, budget, and provenance. Sandbox runs default to read-only/non-mutating tools, bounded context, timeout, and cost limits. Members may test their drafts read-only; `admin`/`owner` approve shared publication and normal tool grants; only `owner` approves mutating sandbox policy or workspace-wide sensitive tools.

## Subtasks

- [ ] Build normalized draft diff and permission review UI with validation warnings.
- [ ] Add bounded sandbox-run service/state with cancellation and auditable results.
- [ ] Wire review UI to canonical `Task-agent-install-lifecycle.md` publish/install/activate procedures and `Task-agent-registry-api.md` draft discard; do not duplicate lifecycle endpoints. Requested context access remains ungranted until separately authorized.
- [ ] Add tests for privilege escalation, mutating tool denial, budget enforcement, stale versions, and audit records.

## Owner or assignee

`unassigned`

## Status

`ready`

## Estimation

`M`

## Acceptance criteria

- [ ] Members can run read-only bounded tests for their own drafts but cannot publish, activate, or grant tools.
- [ ] `admin`/`owner` can approve workspace publication and ordinary allowlisted tools; only `owner` can approve mutating sandbox policy or sensitive workspace-wide grants.
- [ ] Every activation references an immutable reviewed version and records actor, diff, grants, budget, and test result.
- [ ] Invalid/stale drafts cannot be activated, and no test leaks provider credentials or bypasses tenant-scoped tools.
- [ ] `pnpm lint && pnpm type-check && pnpm test` pass.

## Dependencies and access boundary

`Task-agent-builder-editor-drafts.md`, `Task-agent-install-lifecycle.md`, and the bounded execution contract in `Task-agent-harness-chat-streaming.md`. Review UI consumes canonical lifecycle APIs; sandbox context/tool reads also enforce actual context authority, never workspace role alone. Test data defaults to caller-supplied or explicitly authorized context, not arbitrary private project content.

## Links to related Epic / Plan

- Epic: `./Epic-agent-participation.md`
- Plan: `../Plan-workspace-communications.md`