2.5 Sandboxing and Isolation

Build Make's threat model for untrusted AI-generated code and evaluate the five-level isolation spectrum — from iframe sandbox to Firecracker microVM — to understand the startup time, cost, and security tradeoffs that determine the right containment strategy per workload type.