That makes a lot of sense tbh. I believe some of the way around this is only exposing context and actionable tools the agent can and should be using per step but additional guardrails would not hurt at all.