Default-deny network egress for every agent, then allowlist destinations.

This is the one control that would have prevented every incident in the AISI report, the Irregular testbed failures, and arguably the gym booking exploit. It's a firewall rule. Combine it with Docker sbx microVMs and you can run --dangerously-skip-permissions without the prompt fatigue that makes humans rubber-stamp everything at 11pm.