In a new practice folder, build a small gate that sits between you and the commands an agent wants to run.
It runs a command only if it is on a short list of read-only commands, only if every path stays inside one work folder, and
with an empty environment so no secret comes along. Anything else is refused with a clear reason.
Set up a work folder with one harmless note and one made-up secrets file. The gate never changes or deletes anything itself.
Show me how I check it: reading the note works, reading the secrets file is refused, removing the note is refused, and the
note is still there afterwards. Finish by telling me what this gate cannot do.
