The language choice is somewhat orthogonal to the real problem - you still need a governance layer regardless of whether agents execute bash, Python, or TypeScript.

  We built Execwall [1] to sit between the agent and the OS, enforcing argument-level policies. So you can allow git clone but deny git push, or allow chmod 644 but block chmod 777. Works with any shell or execution method.

  The key insight is that "restricted subsets" of languages still need policy enforcement at runtime - an agent can construct dangerous commands dynamically even in a sandboxed language.

  [1] https://github.com/sundarsub/execwall