Determinism: via sandboxing builds, it’s a little leaky by default (but getting better). See https://bazel.build/basics/hermeticity

Parallelism: Easier with sandboxing, but the build declares all inputs/outputs so it builds a merkle tree and strictly inforces a DAG. This way you can parallelize independent subgraphs and cache at a fine grained level.