You're absolutely not overthinking this. The core issue is that agents, by default, inherit your full user permissions. So when they execute arbitrary code or access files, they can do anything you can do. A misstep or malicious instruction becomes a direct risk to your machine, credentials, and projects.

This is why we need structural isolation, not just hoping the agent behaves. Kernel-level sandboxing is the approach that makes unauthorised actions structurally impossible. We built nono for exactly this purpose (disclosure: I'm a part of the community): it uses Landlock on Linux and Seatbelt on macOS to create default-deny environments.

With nono, you can restrict an agent's filesystem access to only its project directory, block network access, and prevent it from touching things like ~/.ssh or ~/.aws. The restrictions are enforced by the OS, so there's no API for the agent to bypass. For an OpenClaw setup, it could look like this: nono run --allow ./my-project --net-block -- openclaw. It's open source on GitHub if you want to check it out: github.com/always-further/nono