Ack on the guardrail analogy.
On fireworks - do you just run serverless or do you take their dedicated instance. My question is how do you ensure that the model is not being manipulated to getting stuff it shouldn’t be.
It doesn't matter where the models are, that's just a traditional API server. The agent harness is the thing that can read files and make http calls (to exfiltrate) and that's regular software running somewhere else. So one typically puts the harness in a sandbox and puts extra LLM calls in to guardrail (prompt / tool call checks).
I'm planning to do something like this for myself as an OpenCode plugin, but to stop my message and record it for clarity or block angry