I'm very close to starting to give Claude Code access to real production infra/data on my main business. The only thing left is a way to restrict its access to mitigate prompt injection types of attack. The current sandbox/firewall can limit access to certain services/hosts, but it is still not enough. For example, I can limit all network requests to http://github.com only, but during an attack, the attacker can tell the AI to push confidential data via another GitHub repo. I only want it to…