This is exactly the right approach for sensitive data + LLMs. We use a similar pattern for password automation:

- Credentials never flow through LLM context - Agent triggers actions via callbacks - Passwords injected at the last mile, invisible to the model

The key insight: you can get all the benefits of AI agents without exposing sensitive data to the model. Client-side execution + careful context isolation makes this possible.

For anyone building AI agents that handle PII/credentials, this WASM approach is worth studying.