All the sandboxing stuff is neat but the weakest link in these claw setups is not root access on the machine but root access to your life (Gmail, calendar, etc)

why give it root access to your life? i don't use these tools but it seems like you should never give anything that access. if a claw needs email, set up a google account just for it and forward relevant stuff to it. share your calendar with it. whatever, just don't let it "be" you.

access control, provisioning, and delegation have been solved for a very long time now.

This is true, but the attack surface on your life is decreased by better security around the entire setup.

But I fundamentally agree that there is just too much overlap between what makes claws useful and what makes them insecure.