← All guides
Guide 03 · Advanced
The sandbox pipeline, end to end
Five tool calls, one trust boundary, one self-contained HTML report. What the agent actually does between your prompt and your file.
The trust boundary — what flows in, what flows out
The sandbox sits inside a strict trust boundary. Data and the model's code-execution capability live inside the boundary. The code itself cannot call external services, cannot mutate other content, cannot reach back into SharePoint to delete or rewrite things on your behalf.
Data enters. Code runs against it. Artifacts exit. Nothing else crosses the boundary in either direction.
Constraint is the security model. No matter what a user throws at the prompt — even prompt-injection attempts hidden in document content — the worst the sandbox can do is produce a strange output file. It cannot pivot, exfiltrate, or escalate. That property is why Microsoft is comfortable letting users hand it 30 MB of arbitrary data and asking it to "do something useful."
"Sandboxes are slow and limited — that's why this is restricted." The sandbox is restricted on purpose. It is fast, runs real JavaScript, and can produce images, JSON, or HTML — it just cannot phone home.
The five-step tool pipeline
Behind the magic, a typical AI-in-SharePoint run is just a chain of named tool calls. The 72K-row demo runs roughly five steps:
1. find_files → returns metadata for the 12 CSVs (no content)
2. read_files → loads bytes into tool storage (content_return: false)
3. run_in_sandbox → executes generated JS to aggregate the data → 27 KB JSON
4. run_in_sandbox → generates the HTML report (charts, CSS, JS inline)
5. create_file → saves the report into the document library
Each step has a narrow job. The model picks the next step based on the last step's output. That is the workflow — there is no hidden second brain.
The Unix analogy is exact. find_files is find. read_files is cat with a content-suppression flag. The sandbox steps are node or python invocations on stored data. create_file is cp into a library. The model wires them together based on the prompt.
"There's a hidden LLM call that 'thinks' over the data between steps." There is not. The model only sees tool inputs, tool outputs, and structural summaries. Heavy lifting always happens inside run_in_sandbox.
Self-contained HTML — no CDN, no dependencies
The final HTML report has everything baked in: chart-drawing code, CSS, JavaScript, even a hand-rolled canvas charting engine. There is no <script src="charts.js"> tag pulling from a CDN, because the sandbox cannot reach out to fetch one.
A constraint becomes a feature. Because the sandbox can't depend on external code, every output file is fully portable, shareable, and offline-friendly.
This is also why a second sandbox call generates the HTML — the agent has to assemble the JSON analytics from step 3 into a standalone document. The JSON is ~27 KB; the final HTML wraps it with rendering code so anyone can open the file in a browser and interact with the report without any backend.
"These reports are charts pointing at a live data source." They are not. The report is a snapshot — it has the data baked into it. To refresh, you re-run the agent, which produces a new file.
Flashcards — Advanced
03 · Advanced
Trust Boundary
tap to reveal →
The strict edge around the sandbox. Data and code-execution stay inside. No outbound network, no mutation of other content, no escape — only the produced artifact crosses out.
← tap to flip back
03 · Advanced
find_files
tap to reveal →
First tool call in a typical run. Returns file metadata matching the prompt — names, sizes, columns — without transferring content.
← tap to flip back
03 · Advanced
run_in_sandbox
tap to reveal →
Executes the JavaScript the model has generated against data in tool storage. Produces a new artifact — JSON analytics, an image, or an HTML file.
← tap to flip back
03 · Advanced
Self-Contained Report
tap to reveal →
An HTML file that includes all CSS, JS, and data inline. No CDN dependencies, no live data source. Portable, shareable, snapshot in time.
← tap to flip back
03 · Advanced
create_file
tap to reveal →
Final tool call in the pipeline. Writes the sandbox-generated artifact into the SharePoint document library where the user can open it.
← tap to flip back