Uh why aren’t you using allowlists to prevent exfiltration to random domains?

I do this at the tool registry layer but this is a good idea for the agent sandbox itself