honestly the simplest guardrail is just not letting the agent touch anything outside the repo dir, scope it down and most of these horror stories never happen