1Password also supports this BUT that does not prevent your agent from being forwarded and you still have to inspect each command being used if you don't trust your agent.

Halfway better would be a separate key for each concern, then check that the key you expect to be used is being used before authorizing.