databricks-agentbricks 0.7.0__tar.gz → 0.7.1__tar.gz

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: databricks-agentbricks
-Version: 0.7.0
+Version: 0.7.1
 Summary: Agent Bricks CLI and AgentKit SDK for custom agents on Databricks
 Author-email: Databricks <agent-feedback@databricks.com>
 License-File: NOTICE
@@ -837,7 +837,7 @@ agentbricks [-p <profile>] [-o text|json]
     unbind     [--source PATH]
     list | get [--experiment-name NAME | --experiment-id ID] [--source PATH]
   tools
-    add sandbox      --scope SCOPE [--scope SCOPE ...]
+    add sandbox      [--name NAME] [--auth user|app]
                      [--no-databricks-access-token-included] [--source PATH]
     add mcp          SERVICE [--name NAME] [--source PATH]
     add uc-function  FUNCTION [--name NAME] [--auth user|app] [--source PATH]
@@ -987,7 +987,7 @@ add` updates only this file; direct TOML edits have the same behavior. Both mana
 adapters read the managed bindings at runtime without generating or patching agent source:
 
 ```sh
-agentbricks tools add sandbox --scope volume:main.data.files
+agentbricks tools add sandbox
 agentbricks tools add mcp system.ai.web_search
 agentbricks tools add uc-function catalog.schema.lookup_ticket
 agentbricks tools add genie-one
@@ -1184,9 +1184,9 @@ points to that project's file. JSON add output includes its path in `manifest`.
 
 `agentbricks tools list` discovers **available integrations to add**, not configured bindings. By default
 it shows built-in add recipes and caller-visible MCP Services in `system.ai`. A recipe may still
-need your resources: sandbox scopes, a concrete UC function name, or a Genie Space ID. Genie One
-needs no additional argument. `system.ai.sandbox` is represented by its scoped recipe rather than
-a second unscoped add command. The list does not enumerate every workspace schema, individual
+need your resources: a concrete UC function name or a Genie Space ID. Sandbox and Genie One need no
+additional argument. `system.ai.sandbox` is represented by the `tools add sandbox` recipe rather
+than a generic `tools add mcp` command. The list does not enumerate every workspace schema, individual
 operations inside MCP services, or custom Python tools.
 
 `agentbricks tools add mcp` looks up the service in the selected workspace before writing `agent.toml`.
@@ -1246,22 +1246,41 @@ If a manifest with `server = "agentbricks"` contains `source = { kind = "python"
 `[[tools]]` entry; the decorated tool in `agent/tools/` remains active. `agentbricks dev` and `agentbricks deploy`
 do not generate or patch Python tool code, and do not alter the manifest's `[[tools]]` bindings.
 
-Sandbox scopes support volumes only and default to read-only access. Repeat `--scope` to allow more
-than one volume, use `volume:catalog.schema.volume`, and use `--permission read_write` only when the
-agent needs writes. Every sandbox call carries this fixed downscope in MCP `_meta`, outside the tool
-arguments controlled by the model. New sandbox bindings also expose the selected Databricks
-credential to sandbox code by default:
+Sandbox code runs with the selected identity's own Unity Catalog access: the request user for
+`auth = "user"` (the default) or the App service principal for `auth = "app"`. Grant that identity
+only the data the agent needs. New sandbox bindings also expose the selected Databricks credential to
+sandbox code by default:
 
 ```toml
 [[tools]]
 id = "sandbox"
 auth = "user"
 source = { kind = "sandbox", service = "system.ai.sandbox" }
-policy = { downscope = [{ resource = "volume:main.data.files", permission = "read_only" }], databricks_access_token_included = true }
+policy = { databricks_access_token_included = true }
 ```
 
-Table sandbox scopes are not supported yet because Databricks Connect does not support table
-downscoping. Workspace sandbox scopes are also not supported yet; they have not been validated
+Every sandbox call carries this fixed policy in MCP `_meta`, outside the tool arguments controlled
+by the model, with an empty `downscope`.
+
+Sandbox resource scopes are not supported: the Sandbox API backend of `system.ai.sandbox` rejects any
+non-empty `_meta.downscope`. The scoping implementation (`--scope`, `--permission`, and
+`policy.downscope`) is retained behind a disabled code-level gate, `SANDBOX_DOWNSCOPE_ENABLED`, so it
+can be enabled when the backend supports resource policies. There is no CLI option to bypass that
+gate. While it is disabled, `agentbricks tools add sandbox --scope ...` fails without changing the
+project, and `agentbricks dev`, `agentbricks deploy`, and the runtime reject a manifest that still
+declares `policy.downscope`:
+
+```text
+Tool 'sandbox' declares policy.downscope, which system.ai.sandbox does not support: sandbox code
+runs with the selected identity's own Unity Catalog access. Remove policy.downscope from the
+[[tools]] entry with id = 'sandbox' in agent.toml.
+```
+
+To fix an existing project, delete the `downscope = [...]` entry from that tool's `policy` table and
+keep `databricks_access_token_included`. Then grant the sandbox identity access to the data it needs.
+
+When scopes are enabled, table sandbox scopes remain unsupported because Databricks Connect does not
+support table downscoping. Workspace sandbox scopes are also not supported yet; they have not been validated
 against a live workspace. Use a volume instead. Existing `table:` and `workspace:` entries must be
 removed from `agent.toml` before using `agentbricks dev` or `agentbricks deploy`.
 

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/README.md

@@ -796,7 +796,7 @@ agentbricks [-p <profile>] [-o text|json]
     unbind     [--source PATH]
     list | get [--experiment-name NAME | --experiment-id ID] [--source PATH]
   tools
-    add sandbox      --scope SCOPE [--scope SCOPE ...]
+    add sandbox      [--name NAME] [--auth user|app]
                      [--no-databricks-access-token-included] [--source PATH]
     add mcp          SERVICE [--name NAME] [--source PATH]
     add uc-function  FUNCTION [--name NAME] [--auth user|app] [--source PATH]
@@ -946,7 +946,7 @@ add` updates only this file; direct TOML edits have the same behavior. Both mana
 adapters read the managed bindings at runtime without generating or patching agent source:
 
 ```sh
-agentbricks tools add sandbox --scope volume:main.data.files
+agentbricks tools add sandbox
 agentbricks tools add mcp system.ai.web_search
 agentbricks tools add uc-function catalog.schema.lookup_ticket
 agentbricks tools add genie-one
@@ -1143,9 +1143,9 @@ points to that project's file. JSON add output includes its path in `manifest`.
 
 `agentbricks tools list` discovers **available integrations to add**, not configured bindings. By default
 it shows built-in add recipes and caller-visible MCP Services in `system.ai`. A recipe may still
-need your resources: sandbox scopes, a concrete UC function name, or a Genie Space ID. Genie One
-needs no additional argument. `system.ai.sandbox` is represented by its scoped recipe rather than
-a second unscoped add command. The list does not enumerate every workspace schema, individual
+need your resources: a concrete UC function name or a Genie Space ID. Sandbox and Genie One need no
+additional argument. `system.ai.sandbox` is represented by the `tools add sandbox` recipe rather
+than a generic `tools add mcp` command. The list does not enumerate every workspace schema, individual
 operations inside MCP services, or custom Python tools.
 
 `agentbricks tools add mcp` looks up the service in the selected workspace before writing `agent.toml`.
@@ -1205,22 +1205,41 @@ If a manifest with `server = "agentbricks"` contains `source = { kind = "python"
 `[[tools]]` entry; the decorated tool in `agent/tools/` remains active. `agentbricks dev` and `agentbricks deploy`
 do not generate or patch Python tool code, and do not alter the manifest's `[[tools]]` bindings.
 
-Sandbox scopes support volumes only and default to read-only access. Repeat `--scope` to allow more
-than one volume, use `volume:catalog.schema.volume`, and use `--permission read_write` only when the
-agent needs writes. Every sandbox call carries this fixed downscope in MCP `_meta`, outside the tool
-arguments controlled by the model. New sandbox bindings also expose the selected Databricks
-credential to sandbox code by default:
+Sandbox code runs with the selected identity's own Unity Catalog access: the request user for
+`auth = "user"` (the default) or the App service principal for `auth = "app"`. Grant that identity
+only the data the agent needs. New sandbox bindings also expose the selected Databricks credential to
+sandbox code by default:
 
 ```toml
 [[tools]]
 id = "sandbox"
 auth = "user"
 source = { kind = "sandbox", service = "system.ai.sandbox" }
-policy = { downscope = [{ resource = "volume:main.data.files", permission = "read_only" }], databricks_access_token_included = true }
+policy = { databricks_access_token_included = true }
 ```
 
-Table sandbox scopes are not supported yet because Databricks Connect does not support table
-downscoping. Workspace sandbox scopes are also not supported yet; they have not been validated
+Every sandbox call carries this fixed policy in MCP `_meta`, outside the tool arguments controlled
+by the model, with an empty `downscope`.
+
+Sandbox resource scopes are not supported: the Sandbox API backend of `system.ai.sandbox` rejects any
+non-empty `_meta.downscope`. The scoping implementation (`--scope`, `--permission`, and
+`policy.downscope`) is retained behind a disabled code-level gate, `SANDBOX_DOWNSCOPE_ENABLED`, so it
+can be enabled when the backend supports resource policies. There is no CLI option to bypass that
+gate. While it is disabled, `agentbricks tools add sandbox --scope ...` fails without changing the
+project, and `agentbricks dev`, `agentbricks deploy`, and the runtime reject a manifest that still
+declares `policy.downscope`:
+
+```text
+Tool 'sandbox' declares policy.downscope, which system.ai.sandbox does not support: sandbox code
+runs with the selected identity's own Unity Catalog access. Remove policy.downscope from the
+[[tools]] entry with id = 'sandbox' in agent.toml.
+```
+
+To fix an existing project, delete the `downscope = [...]` entry from that tool's `policy` table and
+keep `databricks_access_token_included`. Then grant the sandbox identity access to the data it needs.
+
+When scopes are enabled, table sandbox scopes remain unsupported because Databricks Connect does not
+support table downscoping. Workspace sandbox scopes are also not supported yet; they have not been validated
 against a live workspace. Use a volume instead. Existing `table:` and `workspace:` entries must be
 removed from `agent.toml` before using `agentbricks dev` or `agentbricks deploy`.
 

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "databricks-agentbricks"
-version = "0.7.0"
+version = "0.7.1"
 description = "Agent Bricks CLI and AgentKit SDK for custom agents on Databricks"
 authors = [
     { name="Databricks", email="agent-feedback@databricks.com" },

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/cli/mcp.py

@@ -71,5 +71,5 @@ def _list_services(client: Any, schema: str) -> list[dict[str, str]]:
 
 def _add_command(service: str) -> str:
     if service == "system.ai.sandbox":
-        return "agentbricks tools add sandbox --scope volume:catalog.schema.volume"
+        return "agentbricks tools add sandbox"
     return f"agentbricks tools add mcp {service}"

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/cli/tools.py

@@ -14,6 +14,7 @@ from databricks_agentbricks.presentation import render
 from databricks_agentbricks.presentation.help import _example_epilog
 from databricks_agentbricks.projects.agent_project import AgentProject, Scope, ToolSpec
 from databricks_agentbricks.projects.config import require_managed_tool_support
+from databricks_agentkit.runtime import tool_manifest
 
 
 def _identifier(value: str) -> str:
@@ -104,13 +105,21 @@ def add_sandbox_to_manifest(
     obj: Any,
     source: pathlib.Path,
     scopes: tuple[str, ...],
-    permission: str,
+    permission: str | None,
     *,
     tool_id: str = "sandbox",
     auth: Literal["user", "app"] = "user",
     databricks_access_token_included: bool = True,
 ) -> None:
     """Shared implementation for the nested command and compatibility alias."""
+    if not tool_manifest.SANDBOX_DOWNSCOPE_ENABLED and (scopes or permission is not None):
+        raise AgentCliError(
+            "--scope and --permission are not supported for sandbox tools.",
+            hint="system.ai.sandbox does not accept resource scopes; sandbox code runs with the "
+            "selected identity's own Unity Catalog access. Run `agentbricks tools add sandbox` "
+            "without --scope or --permission.",
+        )
+    permission = permission or "read_only"
     parsed: list[Scope] = []
     seen: set[tuple[str, str]] = set()
     for value in scopes:
@@ -140,8 +149,8 @@ def tools() -> None:
     wire it in. `agentbricks tools add` manages these Databricks-managed tool types:
 
     \b
-      sandbox       Query Unity Catalog data via system.ai.sandbox, scoped
-                    to the volumes you choose.
+      sandbox       Run code in a Databricks sandbox (system.ai.sandbox) with
+                    the selected identity's Unity Catalog access.
       mcp           A Databricks-managed MCP service (see `agentbricks tools list --kind mcp`),
                     e.g. system.ai.web_search.
       uc-function   An existing Unity Catalog function (catalog.schema.function).
@@ -183,14 +192,15 @@ def _source_option(function):
     "--scope",
     "scopes",
     multiple=True,
-    required=True,
+    hidden=not tool_manifest.SANDBOX_DOWNSCOPE_ENABLED,
     help="Allowed volume: resource. Repeat for multiple scopes.",
 )
 @click.option(
     "--permission",
     type=click.Choice(["read_only", "read_write"]),
-    default="read_only",
-    show_default=True,
+    default=None,
+    hidden=not tool_manifest.SANDBOX_DOWNSCOPE_ENABLED,
+    help="Access for every --scope resource (default: read_only).",
 )
 @click.option("--name", "tool_id", default="sandbox", show_default=True)
 @click.option("--auth", type=click.Choice(["user", "app"]), default="user", show_default=True)
@@ -205,15 +215,17 @@ def _source_option(function):
 def add_sandbox(
     obj: Any,
     scopes: tuple[str, ...],
-    permission: str,
+    permission: str | None,
     tool_id: str,
     source: pathlib.Path,
     auth: Literal["user", "app"],
     databricks_access_token_included: bool,
 ) -> None:
-    """Add a data sandbox tool (system.ai.sandbox), scoped to specific Unity Catalog resources.
+    """Add a sandbox tool (system.ai.sandbox) that runs code with the selected identity's access.
 
-    Review the target project's agent.toml to check configured managed tools and MCP bindings.
+    Sandbox code can read and write whatever Unity Catalog data the user (--auth user) or the App
+    service principal (--auth app) can. Review the target project's agent.toml to check configured
+    managed tools and MCP bindings.
     """
     add_sandbox_to_manifest(
         obj,
@@ -338,8 +350,8 @@ def list_tools(obj: Any, kind: str | None, schema: str | None) -> None:
 
     By default, show built-in add recipes plus caller-visible MCP Services in system.ai.
     --kind mcp limits discovery to MCP Services; --schema catalog.schema replaces system.ai.
-    Sandbox recipes require scopes; UC-function and Genie Agent recipes require concrete resource
-    identifiers. Genie One needs no additional argument.
+    UC-function and Genie Agent recipes require concrete resource identifiers. Sandbox and Genie
+    One recipes need no additional argument.
 
     No agent project is required. MCP discovery uses your Databricks profile; local recipes do
     not authenticate. This does not scan every workspace schema or list individual MCP operations.

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/presentation/help.py

@@ -491,19 +491,13 @@ _EXAMPLES: dict[CommandPath, tuple[Example, ...]] = {
     ),
     ("tools",): (
         ("agentbricks tools add --help", "see all tool types you can add"),
-        (
-            "agentbricks tools add sandbox --scope volume:main.data.files",
-            "add a data sandbox tool",
-        ),
+        ("agentbricks tools add sandbox", "add a sandbox tool"),
         ("agentbricks tools add mcp system.ai.web_search", "add a managed MCP tool"),
         ("agentbricks tools remove mcp system.ai.web_search", "remove a tool binding"),
         ("agentbricks tools list", "browse available integrations to add"),
     ),
     ("tools", "add"): (
-        (
-            "agentbricks tools add sandbox --scope volume:main.data.files",
-            "add a data sandbox tool",
-        ),
+        ("agentbricks tools add sandbox", "add a sandbox tool"),
         ("agentbricks tools add mcp system.ai.web_search", "add a managed MCP tool"),
         (
             "agentbricks tools add uc-function catalog.schema.lookup_ticket",
@@ -513,9 +507,10 @@ _EXAMPLES: dict[CommandPath, tuple[Example, ...]] = {
         ("agentbricks tools add genie-agent SPACE_ID", "add tools for one Genie Space"),
     ),
     ("tools", "add", "sandbox"): (
+        ("agentbricks tools add sandbox", "add a sandbox tool that runs as the calling user"),
         (
-            "agentbricks tools add sandbox --scope volume:main.data.files",
-            "add a data sandbox tool",
+            "agentbricks tools add sandbox --auth app",
+            "run sandbox code as the App service principal",
         ),
     ),
     ("tools", "add", "mcp"): (

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/projects/agent_project.py

@@ -100,6 +100,12 @@ class Scope:
     permission: str = "read_only"
 
     def __post_init__(self) -> None:
+        if not tool_manifest.SANDBOX_DOWNSCOPE_ENABLED:
+            raise AgentCliError(
+                "Sandbox scopes are not supported.",
+                hint="system.ai.sandbox does not accept resource scopes; sandbox code runs with "
+                "the selected identity's own Unity Catalog access.",
+            )
         if self.kind == "table" and not tool_manifest.SANDBOX_TABLE_SCOPES_ENABLED:
             raise AgentCliError(
                 "Table sandbox scopes are not supported yet.",
@@ -202,8 +208,6 @@ class ToolSpec:
         if kind == "sandbox":
             if self.source.service != "system.ai.sandbox":
                 raise AgentCliError("Sandbox tools must bind system.ai.sandbox.")
-            if not self.policy.downscope:
-                raise AgentCliError("Sandbox tools require at least one scope.")
         elif kind == "mcp":
             if self.source.service is None:
                 raise AgentCliError("MCP tools require a service.")
@@ -229,7 +233,7 @@ class ToolSpec:
         cls,
         tool_id: str,
         *,
-        scopes: Sequence[Scope],
+        scopes: Sequence[Scope] = (),
         auth: Literal["user", "app"] | None = None,
         databricks_access_token_included: bool = True,
     ) -> "ToolSpec":
@@ -407,6 +411,8 @@ def _tool_from_manifest(value: object) -> ToolSpec:
     downscope_value = policy_value.get("downscope", [])
     if not isinstance(downscope_value, list):
         raise AgentCliError("Tool policy downscope must be an array.")
+    if downscope_value and not tool_manifest.SANDBOX_DOWNSCOPE_ENABLED:
+        raise AgentCliError(tool_manifest.downscope_unsupported_message(tool_id))
     databricks_access_token_included = policy_value.get("databricks_access_token_included", False)
     if not isinstance(databricks_access_token_included, bool):
         raise AgentCliError("Tool policy databricks_access_token_included must be a boolean.")
@@ -446,14 +452,15 @@ def _tool_table(spec: ToolSpec) -> Any:
         if value is not None:
             source_values[key] = value
     table.add("source", _inline_table(source_values))
-    if spec.policy.downscope:
-        downscope = tomlkit.array()
-        for scope in spec.policy.downscope:
-            downscope.append(
-                _inline_table({"resource": scope.resource, "permission": scope.permission})
-            )
+    if spec.source.kind == "sandbox":
         policy = tomlkit.inline_table()
-        policy["downscope"] = downscope
+        if spec.policy.downscope:
+            downscope = tomlkit.array()
+            for scope in spec.policy.downscope:
+                downscope.append(
+                    _inline_table({"resource": scope.resource, "permission": scope.permission})
+                )
+            policy["downscope"] = downscope
         policy["databricks_access_token_included"] = spec.policy.databricks_access_token_included
         table.add("policy", policy)
     return table

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/templates/agent-langgraph/pyproject.toml

@@ -9,7 +9,7 @@ authors = [
 requires-python = ">=3.11"
 dependencies = [
     # Agent Bricks includes the HTTP runtime; this extra adds the langgraph framework adapter.
-    "databricks-agentbricks[langgraph]>=0.7.0",
+    "databricks-agentbricks[langgraph]>=0.7.1",
     "databricks-langchain==0.21.0",
     "mcp<2",  # langchain-mcp-adapters 0.3.x uses the MCP 1.x API.
     "uvicorn>=0.41.0",

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/templates/agent-openai/pyproject.toml

@@ -9,7 +9,7 @@ authors = [
 requires-python = ">=3.11"
 dependencies = [
     # Agent Bricks includes the HTTP runtime; this extra adds the openai framework adapter.
-    "databricks-agentbricks[openai]>=0.7.0",
+    "databricks-agentbricks[openai]>=0.7.1",
     "uvicorn>=0.41.0",
     "python-dotenv>=1.2.1",
     "databricks-sdk>=0.124.0",

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/templates/custom-agent-langgraph/pyproject.toml

@@ -5,7 +5,7 @@ description = "LangGraph agent with a custom FastAPI server"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-    "databricks-agentbricks>=0.7.0",
+    "databricks-agentbricks>=0.7.1",
     "databricks-langchain==0.21.0",
     "databricks-sdk>=0.124.0",
     "fastapi>=0.129.0",

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentbricks/templates/custom-agent-openai/pyproject.toml

@@ -5,7 +5,7 @@ description = "OpenAI Agents SDK agent with a custom FastAPI server"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-    "databricks-agentbricks>=0.7.0",
+    "databricks-agentbricks>=0.7.1",
     "databricks-openai>=0.13.0",
     "databricks-sdk>=0.124.0",
     "fastapi>=0.129.0",

{databricks_agentbricks-0.7.0 → databricks_agentbricks-0.7.1}/src/databricks_agentkit/runtime/tool_manifest.py

@@ -32,6 +32,18 @@ def model_service_env(role: str = DEFAULT_MODEL_ROLE) -> str:
 
 # Enable only once Databricks Connect supports table downscoping.
 SANDBOX_TABLE_SCOPES_ENABLED = False
+# Enable only once the Sandbox API backend of system.ai.sandbox accepts resource policies; it
+# currently rejects any non-empty `_meta.downscope`, so sandbox calls must send an empty one.
+SANDBOX_DOWNSCOPE_ENABLED = False
+
+
+def downscope_unsupported_message(tool_id: str) -> str:
+    """The action-oriented error for a manifest that declares a downscope while it is disabled."""
+    return (
+        f"Tool {tool_id!r} declares policy.downscope, which system.ai.sandbox does not support: "
+        "sandbox code runs with the selected identity's own Unity Catalog access. "
+        f"Remove policy.downscope from the [[tools]] entry with id = {tool_id!r} in agent.toml."
+    )
 
 
 class ToolManifestError(RuntimeError):
@@ -240,6 +252,8 @@ def _tool(value: object) -> ToolRecord:
         raise RuntimeError("Only sandbox bindings accept policy.databricks_access_token_included.")
     tool_id = _required_string(value.get("id"), "a tool id")
     validate_genie_source(tool_id, source, has_downscope="downscope" in policy)
+    if raw_downscope and not SANDBOX_DOWNSCOPE_ENABLED:
+        raise ToolManifestError(downscope_unsupported_message(tool_id))
     auth = value.get("auth")
     if auth is not None and auth not in ("user", "app"):
         raise ToolManifestError("Tool auth must be 'user' or 'app'.")
@@ -258,8 +272,8 @@ def _tool(value: object) -> ToolRecord:
         databricks_access_token_included=databricks_access_token_included,
         auth=auth,
     )
-    if record.kind == "sandbox" and (record.service != "system.ai.sandbox" or not record.downscope):
-        raise RuntimeError("Sandbox bindings require system.ai.sandbox and a downscope.")
+    if record.kind == "sandbox" and record.service != "system.ai.sandbox":
+        raise RuntimeError("Sandbox bindings require system.ai.sandbox.")
     if record.kind == "mcp" and not record.service:
         raise RuntimeError("MCP bindings require source.service.")
     if record.kind == "uc_function" and not record.function: