One additional containment layer for agent-authored commands is outbound network policy. The wrapper keeps secrets out of transcripts, but a command that receives a credential can still send it to an unexpected host. A per-task allowlist of endpoints, with default-deny outbound access for the command sandbox, would limit where a leaked value can go. I work on Orke at BOMTOBE, a desktop workspace for coding-agent workflows, and this is a useful boundary to make explicit.