I’m wondering how effective sandboxes are if an allowed tool is compromised. CoT monitoring can be effective, but (1) can’t guarantee 100% detection (2) will provide delayed detection. The only reasonable/deterministic protection that I can think of is to limit the number of times a tool is accessed and with what data, in a unit of time (per minute/hour/day) using temporal policies.