I would say: run with it. Assume the model's output is always untrusted. Assume that no rules can be applied to the model itself, only to the container it runs

I would say: run with it. Assume the model's output is always untrusted. Assume that no rules can be applied to the model itself, only to the container it runs in. What kind of sandbox does the model need to be placed in given those assumptions? Simple rules can be followed like: never take a potentially harmful action based on the model's output unless the user has had the ability to review the action, clear the context and apply whitelist validation to the action's parameters before using the model itself to ask the user for confirmation, never put data in the context that you don't want the user to find out, etc... I think it's mostly a matter of UI design, not of prompt engineering.