The strongest part of this framing is treating an agent as untrusted by default. Quick builder question: how are you proving egress stayed on your allowlist, not just that the model claimed it did? We keep coming back to signed tool-call logs plus a hard human gate on writes. CoT alone ages badly the moment a review asks for evidence instead of vibes.