Your post can be succinctly formalized as “there should always be a deterministic validation layer sitting between the agent and anything sensitive it could do”

Is true for interns, should be true for LLMs. There should simply be no way for it to get keys for prod.