[jguarnelli]

it's a fair point sandboxing is necessary. But not sufficient for agents that legitimately need write access. A payment agent needs Stripe. A maintenance agent needs DB writes. You can't sandbox those away. The missing layer is between has access and executes