I want to draw deterministic boundaries around what the agent can do. My view is that if the agent can decide to do something, any attacker that can inject text into its context can do that thing.