Steps

  1. Name the disposable workspace and allowed inputs.
  2. Specify disabled network or an allowlist, scoped identity, and resource limits.
  3. Define termination events and permitted outputs.
  4. Test a harmless task, then clean up the workspace.

Verify and rollback

The contract makes reads, writes, contact, consumption, and cleanup inspectable. Revoke the identity if the sandbox violates a limit.