Two layers of containment

The disposable box holds none of your logins, so hostile code in a file the agent opens runs where there is nothing to take, then the box is gone. The mandate bounds the money, so a spend the operator never approved is refused before it moves. This controls what the agent can spend and where its risky work runs. It does not read the agent's mind, and an agent can still be aimed at a task that fits inside the limits you set.