Guardrails stop being optional.

and ApproveTool to gate the actions that genuinely need a human or a policy check

And the the agent re-implements the tool from scratch in a python VM inside a JS VM

For an unattended agent these are load-bearing, not nice-to-haves

I guess there was no ApprovalTool invoked before posting AI slop