Least privilege over better prompts is the right hierarchy. Once an agent can reach the open net, model alignment is not your blast-radius control. What I keep wanting in every agent stack is the boring trio: default-deny egress, human gate on irreversible writes, and a signed tool-call receipt that survives a prompt rewrite. Curious whether teams are treating eval sandboxes as production security boundaries yet, or still as demo rooms. marker1003e