it's a fair point sandboxing is necessary. But not sufficient for agents that
legitimately need write access. A payment agent needs Stripe. A maintenance agent
needs DB writes. You can't sandbox those away. The missing layer is between has access and executes