The AI environment: context, tools, sandbox, memory

By the end of this page — you can name the four parts of an agent's environment, say which ones contain untrusted data, and explain why "the model has no memory" is half true.

Strip away the branding and every agent environment has four rooms:

Room	What it holds	Lifetime
📄 Context	System prompt + conversation + tool results + retrieved docs — literally everything the model sees on a call	One conversation (bounded by the context window)
🧰 Tools	The functions the model may propose: read file, run command, search web, …	Configured by the harness; standardized by MCP
🏗️ Sandbox	The fence: which files are writable, which commands are allowed, what network is reachable	Set by you/the harness before the agent starts
🧠 Memory	Notes, files, databases the harness writes to and reads back	Persists across sessions — if someone built it

Context: the working bench

Everything the model “knows” during a task is in its context — nothing more. The context window is the ceiling: every tool result, every file read, every retry eats tokens. A well-built harness spends that budget deliberately (trimming old chatter, summarizing finished sub-tasks) because context is the agent’s short-term memory.

Tools: the hands

A tool is a function with a name, a description and a JSON schema for its arguments. The model proposes calls; the harness executes them. MCP has become the common plug that lets the same tools attach to many different agents — think USB-C for AI.

Sandbox: the fence

This is the part most beginners underestimate. A capable agent should never get a bare root shell on your machine. A sane sandbox restricts:

Files — the agent can only touch its project folder
Commands — an allowlist, or human approval for anything risky
Network — blocked by default, or limited to needed domains

The sandbox is your real defense, not the model's "good behaviour". The model is a text predictor; the sandbox is a hard boundary. Rely on the hard boundary.

Memory: built, not born

"The model has no memory" — half true — The *model* forgets everything between calls. The *product* remembers, because the harness writes state to files or a database and reads it back next time. When an agent says "as we discussed yesterday", it is reading its own notes, not recalling.

That’s also why you should treat agent “memories” as data you can inspect, edit or delete — it’s just files.

Which rooms can you trust?

The context room is where untrusted input lives: web pages, emails, PDFs, tool results, other agents’ messages. The model cannot reliably tell data from instructions — and that single fact is the root of prompt injection.