My response was simplified because your question was basic. OpenClaw was one example that fit the pattern, not a claim that every deployment holds the credential in the sandbox. Injection proxies exist and I should have said so. As for showing the data for advantages, I'll refer you to Anthropic and Cloudflare's Code Mode

https://www.anthropic.com/engineering/code-execution-with-mc... https://blog.cloudflare.com/code-mode-mcp/

We have our own, but will defer to 3rd party evidence.

Reinventing progressive disclosure is definitely part of this, but that's only one element of the approach. To be clear, this is all based on what we use internally, deployed in a particular way within our platform. Will leave it up to others to determine how useful it may be for them.

As for authz, that's what the rest of our system does and is beyond the scope of the aclif effort.