jai is doing the right thing for its threat model. The credential layer is a different surface though ... an agent with a broad API token can call initiate_payment or update_vendor_bank on a remote production system and the filesystem sandbox can't help.

Applying the same principle as jai for remote boundaries, we can scope API authority to the task