diff --git a/doc/USAGE.md b/doc/USAGE.md
index 598cb10..ad0c423 100644
--- a/doc/USAGE.md
+++ b/doc/USAGE.md
@@ -143,6 +143,10 @@ rm -r $OLLIE/s/<session-id>               # cancel and remove
 Valid spec keys: `name` (auto-generated if omitted), `cwd` (required), `agent`,
 `backend`, `model`.
 
+### Sandbox
+
+Every `execute_code` invocation runs inside a Landlock sandbox configured by `~/.config/ollie/sandbox/<name>.yaml`. The sandbox wraps each invocation as a new command, so config changes (e.g. granting access to an additional directory) take effect on the next `execute_code` call without restarting the server or session.
+
 ## AI pipelines
 
 `s/bfg` writes to stdout and composes naturally with Unix pipes. When both args