Comment by coder-pm

This looks like a gate before calling a tool but you’re saying your goal is not to containerise it. In that case what would stop the allowed call from, for example sending something outside? Is there something else sitting alongside the gate? Or is this just out of scope?