I’ll freely admit I’m building these rules based more on what I’ve read on other’s people sites and my own previous experiences running failed quasi-sandboxes than actually running a right one, but one element of a sandbox is distinctly to allow the PC’s to choose the direction of the campaign, and that means doing a lot of work in advance.
In The Legacy of the Dragon (or whatever my mini-epic C&C campaign was called) I did the exact opposite. I laid out what appears to be a sandbox environment: a major city and three “dungeons” that were three ruined castles (which I called “caers” after Forgotten Realms). The caers were practically lined up like stops on a railway line, with the PC’s going to one, then the next, then the last after that. I thought it would be helpful because my gaming group was relatively new, and taking away these decisions would make things easier. Moreover the plot, my plot, would slowly grow to its climax as clues were uncovered in each dungeon.
Instead, the campaign got woefully predictable. I realized at one point that I literally knew what I would be gaming for the next six months to a year in advance. And the climax was impressive, but I found myself telling the story at the end like I was reading out of a book to my kids at bedtime. The player’s weren’t engaged as participants, just viewers. To make matters worse, the novice players just learned by “roleplaying games” meant being led around by the nose. It would be literally a year or more of gaming to break them of that.
So, in order to do it right, you do need a few venues mapped out, but scatter them around, leave plenty of rumors, and let the players figure out where they want to go. The means having the work front-end loaded, but then you can continue to add on new venues in advance, always keeping a few areas in play.