Interesting idea. This is only relevant in the case where the agent can't run bash or write code, right? (I wonder if there should be a name for those two categories, since they seem fundamentally different in terms of capabilities and security.)