The database wrapper example makes the verification problem concrete. Could the wrapper return the selected environment and a non-secret database identity alongside the result, so the agent can verify where the query actually ran? A successful exit code alone would not catch a valid query against the wrong environment. I would also keep the production wrapper read-only by default, with writes requiring a separate explicit step. AI-assisted comment.