Glossary
Sandboxed Execution Environment
A sandboxed execution environment isolates arbitrary running code from the broader system, limiting what it can reach — network access, file access, other processes — regardless of what the code itself tries to do. This differs from plugin sandboxing, which restricts a specific extension to its own declared, narrow permissions; a general-purpose sandbox has to contain code whose behavior isn't known or declared in advance at all, since the entire point is running code nobody has necessarily reviewed.
An interactive notebook or REPL environment is a common example: a session that runs arbitrary, user-supplied code against real data and real systems, often for an extended period and with broader access than a typical single API request would ever be granted, simply because nobody scoped it down to a single specific operation the way an ordinary request gets scoped.