+ Do both. A sandbox and this answer different questions: a sandbox limits what a process can
+ reach, and this reads what a call is actually asking for. A container will happily let an
+ agent curl your environment out to a webhook, because that is a normal thing for
+ a process to do. What it catches, this one misses; what this catches, it misses.
+
+ A permission prompt shows you the call and asks. It does not read the result that comes back,
+ which is where injected instructions arrive, and it cannot tell a routine rm from
+ a destructive one because it is not looking at the content. This never approves anything on
+ your behalf, so the prompts still happen. It is a second opinion that has read the text.
+
+ You should, and this has allow and deny lists built in. They run first, deterministically,
+ with no model involved. The limit is that a list names tools rather than what a call does with
+ them: write_file is on your list either way, whether the path is{' '}
+ src/auth.ts or ~/.ssh/authorized_keys.
+
+ For a handful of calls, do. It stops scaling at about the point agents get useful: a single + web fetch can return forty kilobytes, and the instruction hidden in it is one sentence in the + middle. This starts in shadow mode precisely so you read your own log first and decide what + you would have wanted stopped. +
+ ++ That is half of it. A classifier reads results. This also screens calls before they run, which + is the half that catches a destructive command or a secret heading somewhere it should not, + neither of which is prompt injection. The numbers below cover both directions separately. +
+