Divy asks why a sandbox that needed pypi.org during setup still holds that access when model-generated code starts running. His answer is a policy state machine, install through fetch, execute, deliver, and sealed, with one atomic policy swap per boundary and a complete policy written at every step. He is equally careful about what the swap does not do: established connections survive a tightening, and egress says nothing about ingress or the files already inside. The section on what allow_internet_access actually controls once allow_out is non-empty is the one that saves you an afternoon. It reads like the close documentation audit we wish more tutorials did, down to which exceptions to branch on when a policy update fails.
We didn’t write this one — it’s Divy Yadav’s piece, published on Towards AI. The note above is ours; the full article is theirs.