Use Greywall when the operator needs to launch a local coding-agent CLI under a deny-by-default sandbox before granting it normal host access, not when they are merely browsing a sandbox product. The invoke moment is concrete: start the agent through Greywall, apply or learn a least-privilege profile, and review blocked filesystem, network, or command behavior as the run proceeds. That scope boundary, local least-privilege wrapping of agent CLIs with learned profiles and enforced deny rules, is specific enough to publish as a skill rather than a generic sandbox listing.