The 5 essential layers of AI agent sandboxing on Kubernetes The New Stack