Worth being explicit about the threat model, because it decides the design. Isolating against a compromised dependency needs filesystem and egress control. Isolating against your own agent getting prompt-injected needs the credentials to never be inside the sandbox at all. Most setups I see do the first and assume it covers the second.