Which sandbox providers offer “team workspace”?

Several people share machines, billing and keys. Fully: Agent 37, Blaxel, Boat, Daytona, E2B, InstaBox, Lizard, Modal, Morph, Runtime, Sandboxer, Sprites, Tensorlake, Vercel Sandbox and boxd. With a catch: Cloudflare Sandbox.

Which sandbox providers offer “roles and permissions”?

Give people different powers, such as read-only or admin. Fully: Agent 37, Blaxel, Boat, Cloudflare Sandbox, InstaBox, Runtime, Sprites, Vercel Sandbox and boxd. With a catch: Daytona, Lizard, Modal, Sandboxer and Tensorlake.

Which sandbox providers offer “single sign-on”?

Log in through your company's identity provider (SAML or OIDC). Fully: Cloudflare Sandbox and Runtime. With a catch: Blaxel, Daytona, InstaBox, Lizard, Modal, Tensorlake, Vercel Sandbox and boxd.

Which sandbox providers offer “hard spending cap”?

Set a limit the bill cannot go over; machines stop instead. Fully: E2B, InstaBox, Modal and Runtime. With a catch: Boat, Daytona, Sandboxer, Tensorlake and Vercel Sandbox. Not at all: Agent 37, Cloudflare Sandbox and Lizard.

Which sandbox providers offer “usage alerts”?

Get told when spending passes an amount you set. Fully: Blaxel, Cloudflare Sandbox, InstaBox, Sandboxer and Vercel Sandbox. With a catch: Runtime.

Which sandbox providers offer “audit log”?

A record of who did what in the account. Fully: Cloudflare Sandbox and Runtime. With a catch: Daytona, InstaBox, Lizard, Modal, Tensorlake, Vercel Sandbox and boxd. Not at all: Sprites.

Teams and accounts

The idea

A sandbox account is a billing boundary, a permission boundary and sometimes a data boundary. The first question is what the account owns: keys, wallet, machines, snapshots. The second is who can see and spend what.

Spend controls come in three strengths. A hard cap stops machines when reached. A per-key or per-project limit blocks one credential. An alert tells you after the fact. Providers differ on which they offer, and several offer none.

Audit and residency are the enterprise questions. A lifecycle activity log is not a compliance audit log. A compute region is not a data-residency guarantee if backups and control-plane records sit elsewhere.

Where providers split

The claim on the left, the provider's own words on the right

Organisations are usually shared wallets

Sandboxer's organisation is a shared wallet with per-seat pricing; boxd's account is an organisation with owner, admin and member roles; Boat and Agent 37 have workspaces that own keys, wallet and machines. E2B separates a workspace, which shares payment and credits, from projects, which have their own plans and spending limits.

The consequence is that a per-seat plan multiplies. A five-person team on Sandboxer's $20 plan pays $100 a month before usage.

Hard caps are rarer than alerts

Runtime caps spend per key per day and per sandbox over its life. InstaBox has a monthly cap that stops machines. Agent 37 has per-instance budget ceilings, which are not money. Vercel offers spend management that can pause projects.

Lizard says plainly that there is no spending cap, and boxd publishes no budget or alert feature at all. Boat has no dollar cap on a personal account.

SSO, audit and residency

Runtime includes SSO, SCIM and a 400-day audit log free. InstaBox and Lizard put SSO and audit on Enterprise. Vercel sells SAML at $300 a month. Agent 37, Boat, boxd, Sandboxer and Sprites publish no SSO or audit log on the tiers described here.

Residency is separate. Boat and boxd are EU-only. Agent 37 keeps compute in the chosen region but stores backups in the US. InstaBox and Runtime are US-only.

One worked case

The same job at every provider, from the documented defaults

Five people, one runaway agent, one procurement form

A five-person team shares an account. On Tuesday night an agent loops and burns $400 of compute. The same week, procurement asks for SSO and an audit log.

22:00
The loop starts. A hard cap stops the machine; an alert tells you at 08:00.
08:00
You read the bill. Whether the plan multiplies per seat decides what the other four people cost.
10:00
Procurement asks who signed in, what they did, and whether the account supports SAML.

Hard caps are rarer than alerts, and audit logs are rarer than SSO. Runtime is the outlier that includes both free; several providers publish neither on the tiers described here.

What each provider does

Agent 37: Per-instance budget ceilings stop a runaway instance, but they are not a money cap; no audit log or SSO is published.
Blaxel: Admin, member and viewer roles with scoped service accounts; no hard spend cap is published and SAML needs a feature flag.
Boat: Owner, admin and member roles and per-member caps, but start budgets are pooled and there is no audit log or SSO.
boxd: Owner, admin and member roles with keys fenced to one org; no self-serve audit log, SSO or spend cap is published.
Cloudflare Sandbox: Budget alerts email you after the loop; they do not pause or cap anything, and the account ceiling is 1,500 concurrent vCPU.
Daytona: The runaway agent is capped only by the prepaid pool, and every member of the organisation can exec in every running sandbox.
E2B: The workspace shares payment and credits while each project has its own spending limit; SSO and audit coverage are not published.
InstaBox: A monthly spend cap stops machines; SSO, SCIM and audit logs are Enterprise only.
Lizard: Caps on sandboxes, CPU, memory and disk, but no spending cap at all; SSO and audit are Enterprise.
Modal: An environment budget on Team stops the workload at the limit; Starter has no budgets and only three seats.
Morph: Devboxes are shareable inside the organisation and an SSH-key audit endpoint exists; SSO and hard caps are not published.
Runtime: Per-key daily spend limits and a per-sandbox lifetime cap, with SSO, SCIM and a 400-day audit log free.
Sandboxer: A shared wallet with per-member usage caps; plans are per seat and no audit log or SSO is published.
Sprites: Fly organisations and connector management; spend caps, key scopes and audit retention are not published.
Vercel Sandbox: Spend management can pause projects and SAML costs $300 a month; fine-grained Sandbox key scopes are not published.
Tensorlake: Organisations and projects with admin and member roles and project-scoped keys; no budget is published, so a runaway loop is stopped only by an empty credit balance.

What to watch for

The details that decide the answer in practice

01
Whether the plan price multiplies per seat.
02
Whether there is a hard spend cap, a per-key limit, or only an alert.
03
Whether SSO and audit logs are included, enterprise-only, or absent.
04
Whether backups and control-plane data sit in the same region as compute.
05
Whether an API key can be scoped to one sandbox or one project.

Compare all 16

Docs read 28 October 2026

Organisations, key scopes, spend limits, SSO, audit and residency. The features a team needs are rarely the ones a solo builder notices, and several providers only sell them on an enterprise tier.
Provider	Hard spend cap?	Does it?	What that means
Agent 37	Per-instance budget	Partly	Workspaces own keys, wallet and instances; teams have admin and user roles; each instance has a budget ceiling. No audit log or SSO is published, and backups are stored in the US.Agent 37 docs: Members — workspace membership and roles ↗ Agent 37's own wordsdocs-confirmed “A workspace is the account: it owns the API keys, the wallet, and every instance.” Agent 37docs-confirmed
Blaxel	No hard cap	Partly	Workspace roles are admin, member and viewer; service accounts have scoped tokens; SAML and directory sync require a feature flag. No hard spend cap or full audit coverage is published.Blaxel docs: Workspaces, users and roles ↗ Blaxel's own wordsdocs-confirmed “There are three roles that a user or service account can have in a workspace” Blaxeldocs-confirmed
Boat	No dollar cap	Partly	Organisations with owner, admin and member roles, scoped keys and per-member caps. No audit log or SSO is published, and start budgets are pooled across the organisation.Boat docs: Teams ↗ Boat's own wordsdocs-confirmed “The included time, start-rate and concurrency numbers of the plan are one shared pool for the whole organization.” Boatdocs-confirmed
boxd	Not published	Partly	Every account is an organisation with owner, admin and member roles, and keys are fenced to one org. No self-serve audit log, SSO or spend cap is published; machines are EU-only.boxd docs: Organizations and teams ↗ boxd's own wordspricing-page “Every account is an organization.” boxdpricing-page
Cloudflare Sandbox	Alerts only	Partly	Budget alerts are informational and do not cap usage. Concurrency is account-wide: 1,500 vCPU, 6 TiB and 30 TB. No per-sandbox IAM; the account audit log records control-plane actions only.Cloudflare Sandbox docs: Manage account members ↗ Cloudflare Sandbox's own wordsdocs-confirmed “Budget alerts are informational only. They do not pause or cap usage.” Cloudflare Sandboxdocs-confirmed
Daytona	Org-wide resource pool	Partly	Tiers are prepaid top-ups that set an org-wide vCPU, memory and disk pool. Any member or API key can address any running sandbox. SSO is Enterprise; audit logs are role-gated and export is coming soon.Daytona docs: Organizations ↗ Daytona's own wordsdocs-confirmed “Every member of an organization can address that organization's running sandboxes” Daytonadocs-confirmed
E2B	Per-project limit	Partly	A workspace shares payment, credits and invoice; each project has its own plan and spending limit. SOC 2 Type II and a HIPAA BAA path. SSO and audit coverage are not published.E2B docs: Workspaces ↗ E2B's own wordsdocs-confirmed “When a project reaches its spending limit, only that project is blocked.” E2Bdocs-confirmed
InstaBox	Monthly cap stops machines	Partly	Organisations and workspaces with roles, scoped keys and a monthly spend cap that stops machines. SSO, SCIM and audit logs are Enterprise only.InstaBox docs: Account API — templates, usage, limits and key owner ↗ InstaBox's own wordsdocs-confirmed “caps this month's usage beyond the org's allowance” InstaBoxdocs-confirmed
Lizard	No cap at all	Partly	Workspaces, projects and scoped keys, with caps on sandboxes, CPU, memory and disk. No spending cap at all; SSO and audit logs are Enterprise only.Lizard docs: Workspace CLI — members and workspace limits ↗ Lizard's own wordsdocs-confirmed “A scoped key works only inside its projects or workspaces.” Lizarddocs-confirmed
Modal	Environment budgets	Partly	Environment budgets on Team and Enterprise stop workloads at the limit. RBAC is Team+, SSO and audit logs are Enterprise. Starter has 3 seats and 100 containers.Modal docs: Workspaces ↗ Modal's own wordsdocs-confirmed “When the spend limit is reached, Modal stops workloads that would incur additional out-of-pocket charges.” Modaldocs-confirmed
Morph	Not published	Partly	Devboxes are shareable to anyone in the organisation, and an SSH-key audit endpoint exists. SSO, hard spend caps and comprehensive audit coverage are not published.Morph docs: Sharing & collaboration ↗ Morph's own wordsdocs-confirmed “devboxes are shareable live via URL to anyone in your Morph Cloud organization” Morphdocs-confirmed
Runtime	Per-key daily + lifetime	Yes	Roles, compartments that wall off key groups, per-key daily spend limits and a per-sandbox lifetime cap. SSO, SCIM and a 400-day audit log are free.Runtime docs: Teams and the audit log ↗ Runtime's own wordspricing-page “read-only keys, a daily spending limit per key, and compartments” Runtimepricing-page
Sandboxer	Per-member caps	Partly	An organisation is a shared wallet with owner and member roles, scoped keys and per-member usage caps. Plans are per seat, and no audit log or SSO is published.Sandboxer docs: Organizations ↗ Sandboxer's own wordsdocs-confirmed “An organization is a shared wallet: one plan, one balance, and the members who run sandboxes on it.” Sandboxerdocs-confirmed
Sprites	Not published	Partly	Fly.io organisations and connector management in a dashboard. SSO is claimed by a third party; spend caps, key scopes, audit retention and residency are not published.Sprites docs: CLI Authentication (Fly.io account and org switching) ↗ Sprites's own wordsdocs-confirmed “Sprites uses your Fly.io account for authentication” Spritesdocs-confirmed
Vercel Sandbox	Spend management	Partly	Team seats, spend management that can pause projects, and a lifecycle activity log. SAML costs $300 a month; fine-grained Sandbox key scopes and contractual residency are not published.Vercel Sandbox docs: Pro plan: team seats ↗ Vercel Sandbox's own wordsdocs-confirmed “SAML Single Sign-On: $300/month” Vercel Sandboxdocs-confirmed
Tensorlake	Roles + SSOno spend cap	Partly	Org admin and member roles, project admin and member roles, and API keys limited to project-member permissions. SSO over OIDC or SAML is available to org admins but has to be enabled for the organisation. No spend cap, budget alert or audit-log product is published; prepaid credits are the stop, and Pro adds a 1,000-sandbox concurrency ceiling.Tensorlake docs: Access Control — organizations, projects, roles and API keys ↗ Tensorlake's own wordsdocs-confirmed “When the balance reaches zero, Tensorlake blocks new sandbox activity and stops running sandboxes instead of creating a postpaid overage.” Tensorlakedocs-confirmed

The specific capabilities

Each one checked for every provider, with the catch where a version falls short. All capabilities

Teams and accounts: capabilities by provider
Capability	Agent 37	Blaxel	Boat	boxd	Cloudflare Sandbox	Daytona	E2B	InstaBox	Lizard	Modal	Morph	Runtime	Sandboxer	Sprites	Tensorlake	Vercel Sandbox
Team workspace	Agent 37: Yes	Blaxel: Yes	Boat: Yes	boxd: Yes	Cloudflare Sandbox: With a catch. People share the Cloudflare account and its Workers, but there is no per-sandbox sharing or sandbox workspace.	Daytona: Yes	E2B: Yes	InstaBox: Yes	Lizard: Yes	Modal: Yes	Morph: Yes	Runtime: Yes	Sandboxer: Yes	Sprites: Yes	Tensorlake: Yes	Vercel Sandbox: Yes
Roles and permissions	Agent 37: Yes	Blaxel: Yes	Boat: Yes	boxd: Yes	Cloudflare Sandbox: Yes	Daytona: With a catch. Roles decide who can manage the organisation, but any member or key can still run commands in any running sandbox.	E2B: Not published	InstaBox: Yes	Lizard: With a catch. Role-based access is listed only on the Enterprise plan; the Pro plan marks it not included.	Modal: With a catch. Team plan and above. Role-based access starts on the Team plan; the free-to-start Starter plan has no roles.	Morph: Not published	Runtime: Yes. 4 roles	Sandboxer: With a catch. Only two roles exist; there is no read-only role or finer permission.	Sprites: Yes	Tensorlake: With a catch. Admin and member only. Every plan gets two fixed roles, admin and member, at organization and project level; fuller role-based access is listed under the Enterprise plan.	Vercel Sandbox: Yes
Single sign-on	Agent 37: Not published	Blaxel: With a catch. Single sign-on works only after Blaxel switches on a setting for your account.	Boat: Not published	boxd: With a catch. SAML is sold on Enterprise and you have to ask for it.	Cloudflare Sandbox: Yes	Daytona: With a catch. SSO is available only on the Enterprise plan for collaborative organisations.	E2B: Not published	InstaBox: With a catch. Company sign-in, SAML and automatic user sync are listed only on the Enterprise plan.	Lizard: With a catch. SSO and SAML are Enterprise-only; the Pro plan marks them not included.	Modal: With a catch. Okta SSO is listed with audit logs and HIPAA on the Enterprise plan.	Morph: Not published	Runtime: Yes	Sandboxer: Not published	Sprites: Not published	Tensorlake: With a catch. SSO is listed on the Enterprise plan, and the docs say access must be enabled for your organisation.	Vercel Sandbox: With a catch. $300/month. SAML single sign-on is a paid add-on at $300 a month.
Hard spending cap	Agent 37: No. There is no dollar limit you can set; per-instance budgets only cap model spending, and the prepaid wallet is the only ceiling.	Blaxel: Not published	Boat: With a catch. A personal account has no dollar cap; organisations can cap a member's machine time, which stops their new sandboxes.	boxd: Not published	Cloudflare Sandbox: No. Budget alerts only send email; they do not pause or cap anything.	Daytona: With a catch. The ceiling is a prepaid pool of computing resources rather than a dollar amount, and running sandboxes are not stopped when it runs out.	E2B: Yes	InstaBox: Yes	Lizard: No. There is no spending cap at all; only sandbox, CPU, memory and disk caps.	Modal: Yes	Morph: Not published	Runtime: Yes	Sandboxer: With a catch. A member's machine time can be capped, and a zero balance stops new sandboxes, but there is no account-wide dollar cap.	Sprites: Not published	Tensorlake: With a catch. Prepaid credit packs cannot be overspent, but the Pro plan bills overage beyond its included usage.	Vercel Sandbox: With a catch. Spend Management can pause projects at an amount you set, but it is a project pause rather than a sandbox stop.
Usage alerts	Agent 37: Not published	Blaxel: Yes. 90% of quota	Boat: Not published	boxd: Not published	Cloudflare Sandbox: Yes	Daytona: Not published	E2B: Not published	InstaBox: Yes	Lizard: Not published	Modal: Not published	Morph: Not published	Runtime: With a catch. The console warns when credit or free usage is about to run out, but you cannot set your own threshold.	Sandboxer: Yes	Sprites: Not published	Tensorlake: Not published	Vercel Sandbox: Yes
Audit log	Agent 37: Not published	Blaxel: Not published	Boat: Not published	boxd: With a catch. Audit logs are sold with SSO on the Custom/Enterprise line; on self-serve plans the only record is the SSH command history.	Cloudflare Sandbox: Yes	Daytona: With a catch. The log exists, but exporting it for an audit is not shipped yet.	E2B: Not published	InstaBox: With a catch. Audit logs are listed only on the Enterprise plan.	Lizard: With a catch. Audit logs are Enterprise-only; the Pro plan marks them not included.	Modal: With a catch. Audit logs are listed with SSO and HIPAA on the Enterprise plan.	Morph: Not published	Runtime: Yes. 400 days	Sandboxer: Not published	Sprites: No. Fly states plainly that there is no customer-facing audit log of organisation activity or staff access.	Tensorlake: With a catch. Audit logs are not self-serve: you ask support for them.	Vercel Sandbox: With a catch. Audit Logs are a Vercel Enterprise feature; Sandbox-specific coverage is not established.

YesWith a catchNoNot publishedHover or select a mark to see the catch.

Questions to ask before you sign

Each one targets something the documentation does not answer

Does the plan price multiply per seat, and what does a five-person team pay before usage?
Is there a hard spend cap that stops machines, a per-key limit, or only an alert?
Are SSO and audit logs included, enterprise-only, or absent — and how long is the audit log retained?
Do backups and control-plane data sit in the same region as compute?
Can an API key be scoped to one sandbox or one project, and who can see the wallet?

Common questions

Answered from the capability checks; each links to the provider-by-provider detail and its sources

Which sandbox providers offer “team workspace”?: Several people share machines, billing and keys. Fully: Agent 37, Blaxel, Boat, Daytona, E2B, InstaBox, Lizard, Modal, Morph, Runtime, Sandboxer, Sprites, Tensorlake, Vercel Sandbox and boxd. With a catch: Cloudflare Sandbox. See each provider's catch
Which sandbox providers offer “roles and permissions”?: Give people different powers, such as read-only or admin. Fully: Agent 37, Blaxel, Boat, Cloudflare Sandbox, InstaBox, Runtime, Sprites, Vercel Sandbox and boxd. With a catch: Daytona, Lizard, Modal, Sandboxer and Tensorlake. See each provider's catch
Which sandbox providers offer “single sign-on”?: Log in through your company's identity provider (SAML or OIDC). Fully: Cloudflare Sandbox and Runtime. With a catch: Blaxel, Daytona, InstaBox, Lizard, Modal, Tensorlake, Vercel Sandbox and boxd. See each provider's catch
Which sandbox providers offer “hard spending cap”?: Set a limit the bill cannot go over; machines stop instead. Fully: E2B, InstaBox, Modal and Runtime. With a catch: Boat, Daytona, Sandboxer, Tensorlake and Vercel Sandbox. Not at all: Agent 37, Cloudflare Sandbox and Lizard. See each provider's catch
Which sandbox providers offer “usage alerts”?: Get told when spending passes an amount you set. Fully: Blaxel, Cloudflare Sandbox, InstaBox, Sandboxer and Vercel Sandbox. With a catch: Runtime. See each provider's catch
Which sandbox providers offer “audit log”?: A record of who did what in the account. Fully: Cloudflare Sandbox and Runtime. With a catch: Daytona, InstaBox, Lizard, Modal, Tensorlake, Vercel Sandbox and boxd. Not at all: Sprites. See each provider's catch

Part of Running it. Next: put two or three providers side by side.