In sandbox play - as opposed to a cop-out/hybrid where the severity of challenges is scaled to the party - the responsibility for managing threats rests on the shoulders of the players, who have to make choices whether to explore a certain hazardous area, range far from civilisation centres or not, etcetera. Collecting information becomes very valuable. Rumors, and listening to them, is very important;
augury and more advanced divination spells become better lifesavers than
fireball (no exagerration - PCs in my campaigns have been saved more times by the first than the second) and of course, sacrificing to deities or consulting sages for their advice is a prime way loot is spent. This is, in many ways, outside the currently fashionable D&D paradigm. It is often the experienced players with set-in playing procedures, who are less successful in it, and newbies who adapt more quickly (while certain old hands are immediately "at home", and fare very, very well - that's the mythical "player skill" in action
).
Of course, none of this preserves the party from random encounters, or accidentally stumbling into something way over their heads. Here, responsibility gets divided between the DM and his players. The players must shed the mindset that challenges in the world are tailored to their abilities. They must be prepared to say
"We are not going there", they must be prepared to declare
"RUN!", and they must be prepared to negotiate or, yes, grovel/surrender before an obviously superior and intelligent foe. Getting out of an unpleasant situation imposed on them by a demon, lich or dragon (who could, for example, take their valuable equipment, even spell books hostage to prevent flight, or use a magical sort of compulsion) is always possible, while death is very final.
But the DM must excercise care as well. It is not ethical to slaughter the party by a proverbial lightning bolt from the sky. He should provide clues to draw attention to the fact that danger may be present (although, of course, some places may be innately dangerous: weird temples, very ancient ruins, swampland and mountains, for example, are always hazardous in my campaign). He should also handle encounters with a certain amount of flexibility, and
usually allow a way out if there could concievably be one, and the players are willing to take it.
Finally, let it be noted that sandbox play is not for the cautious. It only works properly for players who are risk-takers, and don't
mind a higher death rate. It is, simply put, not always the material of D&D's usual "quest fantasy" when you die more or less without a special significance. I could recount the tales - of Brantar the Cleric, who was flattened by the ceiling, or Mutambo the Fighter who was cut down by enraged amazons, or Grond, Morgos and Panther who were killed by orcs, and Tyr Wulos, Eldon the Purse and Valmard Levandell who came as a rescue party for the previous and were also killed, this time by a shambling mound (well,
except poor Eldon, who died when he accidentally shot the party barbarian in the back). For risk-averse players, or those too attached to PCs, sandbox games are inappropriate, because they induce a sort of paralysis, where, by avoiding risk too successfully, the PCs effectively remove themselves from the ranks of adventurers. Alas, I have seen this in person, and it made for a very boring campaign. Having learned my lessons, I live by the sage advice now seen in my signature:
