How do you handle network egress filtering when an agent legitimately needs to install dependencies or pull docs versus preventing arbitrary outbound traffic during autonomous execution?