Execution boundary
Work runs on the machine selected for the space. A sandbox adds container isolation. A space without a sandbox runs on the host.
Credential boundary
Use named credentials and secrets so sensitive values do not need to appear in prompts or command history.
Policies
Read the canonical Security and Privacy pages for policy details.