If you’re giving local models filesystem access and a code interpreter, you need a governance layer that isn’t the model itself