Comment by Amine Raji

For every agent with web or tool access, write down which outward actions have side effects: form posts, account creation, sending messages, payments, writes to third-party APIs. Make those default-deny at the tool or proxy layer, not in the prompt. A research agent that only needs to read can be limited to GET requests at the egress proxy. Then check your own detection time: when did a person last read a sample of this agent’s transcripts?