The folder read-write config is the right primitive — that's what actually contains an agent when it goes off-script. And +1 on sandbox-exec being the daunting part; the macOS story is the hard bit.