docs: note elevated no-op when unsandboxed

2026-01-08 23:18:09 +01:00
parent b01d7e39d5
commit dc1992cbb5
4 changed files with 7 additions and 0 deletions
--- a/docs/gateway/sandboxing.md
+++ b/docs/gateway/sandboxing.md
@@ -24,6 +24,7 @@ Not sandboxed:
 - The Gateway process itself.
 - Any tool explicitly allowed to run on the host (e.g. `agent.elevated`).
  - **Elevated bash runs on the host and bypasses sandboxing.**
+  - If sandboxing is off, `agent.elevated` does not change execution (already on host). See [Elevated Mode](/tools/elevated).

 ## Modes
 `agent.sandbox.mode` controls **when** sandboxing is used: