This approach is so limiting it seems like it would be better to change the constraints. For example, in the case of a software agent you could run everything i

This approach is so limiting it seems like it would be better to change the constraints. For example, in the case of a software agent you could run everything in a container, only allow calls you trust to not exfiltrate private and make the end result a PR you can review.