I keep seeing the same contradiction: people consider certain activities like "write code that me or my customers run" or "read my email", to be table stakes abilities for an agent. At the same time, they expect some kind of sandbox that prevents even a malicious agent from doing damage. You already gave it the most broad and powerful possible capabilities at the beginning though, there's not even a barn left to close the door on.