Why not let it delete stuff in the current working folder and in tmp, but give it read-only access elsewhere?

Because I often want it to write and execute scripts in it's thinking loop in order to test assumptions or fetch data to come up with better solutions.