Your agent does the work. It can't do the damage.

A real session. The agent runs freely — until it reaches for rm -rf, a secret, or the network. Then the Warden freezes it, and every attempt lands on a tamper-evident log. No mockup; this is the broker's actual output.