The agent crawls some websites and reads some stuff and pushes some buttons. It's my limited understanding that you have
1. Hard limits like "file system permissions" (* never mind it going around for sake of this conversation)
3. On other hand of spectrum, fundamentally soft limits like a prompt "and ask me before you purchase "
2. And then in the middle you have harness enforced limits like "it won't do X with approval"... Those are being sold as hard limits but frequently they have classifiers and heuristics that essentially try to figure out which button on some third party website constitutes a "purchase" and triggers the harness limit.
Bottom line - I don't think such limits are as 100% fool proof as they are advertised / interpreted.
Very happy to be explained wrong :).