Seems cheaper (and so far more robust) to have an agent audit downloaded code