All commands MUST run in sandbox mode - the `dangerouslyDisableSandbox` parameter is disabled by policy.