Least-privilege patterns for LLMs: policy, sandboxing and observability for desktop agents

Practical patterns to enforce least privilege for desktop LLM agents: policy, sandboxing, and observability to prevent exfiltration, cost spikes, and compliance lapses.