MFT sandboxes
You can restrict the area of the file system that the agent can access as part of a transfer. The area that the agent is restricted to is called the sandbox. You can apply restrictions to either the agent or to the user that requests a transfer.
Sandboxes are not supported when the agent is a protocol bridge agent or a Connect:Direct® bridge agent. You can not use agent sandboxing for agents that need to transfer to or from IBM® MQ queues.