Why not let it delete stuff in the current working folder and in tmp, but give it read-only access elsewhere?
Because I often want it to write and execute scripts in it's thinking loop in order to test assumptions or fetch data to come up with better solutions.
That's how codex already works so you're not suggesting anything new, but it doesn't give write access at all of you set it to read only.