diff --git a/wizard-work/beam/path_sandbox.py b/wizard-work/beam/path_sandbox.py
index 24961d0..a657d39 100644
--- a/wizard-work/beam/path_sandbox.py
+++ b/wizard-work/beam/path_sandbox.py
@@ -95,6 +95,10 @@ def is_within(root, target):
         rt = os.path.realpath(target)
     except (OSError, ValueError):
         return False
-    if rr == os.sep:
-        return rt == rr or rt.startswith(rr)
-    return rt == rr or rt.startswith(rr + os.sep)
+    # Use commonpath rather than a raw string prefix so that a root like
+    # /tmp/root cannot be confused with a sibling like /tmp/rootX.
+    try:
+        cp = os.path.commonpath([rr, rt])
+    except ValueError:
+        return False
+    return cp == rr