yes, or you bake them into the environment and do not let it install things on its own

stay human in the loop