What about if you were to use it to write code but the code itself has logic to restrict what it could do based on the execution environment. Whether it's external variables like email Allowlist or flagging emails as not allowed. Your assistant if it tried, it would not have access.

In that sense I agree it could be a problem solved without "ai". Simon's approach does use another language model, maybe we need to build more way of logically sandboxing code or just better fine grained access control