Two of your open questions have answers that fall out of the design as you describe it.

On the first exit row, the attacker's own document on a service the user already trusts: Sentinel holds the real credential, so it can resolve who owns the target resource before it inserts that credential. An upload to a document the user didn't create, and that wasn't shared from inside their organisation, is a new destination whatever the hostname says. A host-level grant can't see that. A check that resolves the owner can.

On persistence: taint should outlive the process. If a tainted process writes to memory or to a skill file, the entry carries the taint, and any later task that loads it loses the fast path. Otherwise the injection gets laundered through memory, and the task that fires it next week looks clean because the email is no longer in context.

Both add cost. The owner lookup is an extra API call per write, and taint on memory will push more requests into the ask path. I'd take both over a grant that trusts a hostname.