The interesting trade-off here is how much of the local environment an agent actually needs. Take a monorepo where a task requires running a specific Homebrew-installed tool, generating code, and spinning up dependent services for integration tests. A sandbox that blocks those workflows pushes you toward workarounds, but letting the agent escape its boundaries too easily creates a different problem. I’d rather expose the exact binaries, writable paths, and network endpoints the task needs than make broader permissions the default.