I do this at the tool registry layer but this is a good idea for the agent sandbox itself

If you give access to bash, cc or wget then you're wide open, no matter how much you tell yourself you're safe.