diff --git a/sandbox/default.yaml b/sandbox/default.yaml
index a71ab43..f0ebcd7 100644
--- a/sandbox/default.yaml
+++ b/sandbox/default.yaml
@@ -1,11 +1,10 @@
-# Default role: combined most-permissive settings from all tasks/roles
+# Default execute_code sandbox configuration.
 cwd: "{CWD}"
 filesystem:
   ro:
     - "{XDG_CONFIG_HOME}/git"
     - "{HOME}/.ssh"
     - "{HOME}/.netrc"
-    - "{HOME}/.local/share/anvillm/mail"
     - "/etc/gitconfig"
     - "/etc/gitattributes"
     - "/etc/ssh/ssh_config"
@@ -30,6 +29,8 @@ filesystem:
     - "{XDG_DATA_HOME}/gh/extensions"
     - "/dev"
   rw:
+    - "{OLLIE_MEMORY_PATH}"
+    - "{OLLIE_PLAN_PATH}"
     - "{HOME}/.ssh/known_hosts"
     - "{HOME}/pCloudDrive"
     - "{HOME}/.pcloud"
@@ -61,7 +62,6 @@ filesystem:
     - "{XDG_CONFIG_HOME}/vim"
     - "{XDG_DATA_HOME}/nvim"
     - "{XDG_STATE_HOME}/nvim"
-    - "{HOME}/.local/share/anvillm"
     - "{OLLIE_MEMORY_PATH}"
     - "{OLLIE_PLAN_PATH}"
     - "{HOME}/.vimrc"
@@ -80,10 +80,10 @@ filesystem:
     - "/proc/self/fd"
     - "/proc/self/cmdline"
   rwx:
-    - "{CWD}"
+    - "{PWD}"
     - "{PLAN9}"
     - "{HOME}/bin"
-    - "{HOME}/mnt"
+    - "{OLLIE}"
     - "{HOME}/.pyenv"
     - "{HOME}/.local/bin"
     - "{HOME}/.sdkman"
@@ -98,14 +98,12 @@ filesystem:
     - "{HOME}/.mcp-auth"
     - "{HOME}/.yarn"
 env:
-  - AGENT_SKILLS_PATH
   - NAMESPACE
   - OLLIE
   - OLLIE_MEMORY_PATH
   - OLLIE_PLAN_PATH
   - HOME
   - TMPDIR
-  - AGENT_ID
   - PLAN9
   - JENKINS_USER_ID
   - JENKINS_API_TOKEN
@@ -118,5 +116,6 @@ env:
   - EDITOR
   - GIT_SEQUENCE_EDITOR
   - SUPERPOWERD_SESSION_TOKEN
+  - PWD
 network:
   unrestricted: true
diff --git a/sandbox/restricted.yaml b/sandbox/restricted.yaml
index 43fe48d..f69137a 100644
--- a/sandbox/restricted.yaml
+++ b/sandbox/restricted.yaml
@@ -1,11 +1,10 @@
-# Restricted sandbox config for execute_code
+# Sample minimal-permission sandbox for execute_code
 cwd: temp  # Use temp workspace (cleaned up after execution)
 filesystem:
   ro:
     - "/etc/alternatives"
     - "/etc/ld.so.cache"
     - "/etc/passwd"
-    - "{HOME}/.local/share/anvillm/mail"
     - "/dev/urandom"
   rox:
     - "/usr"
@@ -21,16 +20,14 @@ filesystem:
     - "{HOME}/.rbenv"
     - "{HOME}/.nvm"
   rw:
+    - "{OLLIE_MEMORY_PATH}"
+    - "{OLLIE_PLAN_PATH}"
     - "/dev/null"
     - "/tmp"
     - "{NAMESPACE}"
-    - "{XDG_RUNTIME_DIR}/superpowerd"
   rwx:
-    - "{CWD}"
-    - "{HOME}/mnt/ollie"
-    - "{HOME}/mnt/anvillm"
-    - "{OLLIE_MEMORY_PATH}"
-    - "{OLLIE_PLAN_PATH}"
+    - "{PWD}"
+    - "{OLLIE}"
 env:
   - NAMESPACE
   - OLLIE
@@ -43,8 +40,9 @@ env:
   - WAYLAND_DISPLAY
   - USER
   - AGENT_ID
-  - SUPERPOWERD_SESSION_TOKEN
-  - SUPERPOWERD_SOCKET_DIR
   - XDG_RUNTIME_DIR
+  - TMPDIR
+  - SUPERPOWERD_SESSION_TOKEN
+  - PWD
 network:
   unrestricted: true