You need an outside process that polices output and actions that runs independently from the agent. It has to be invisible to the agent/orchestrator so it can't

You need an outside process that polices output and actions that runs independently from the agent. It has to be invisible to the agent/orchestrator so it can't work to circumvent it, it should just kill any sub-agent or process that goes down the wrong path (for example, making a POST requests might be blocked if web access is meant to be read-only).