Как защищать function calling от tool abuse: SSRF, RCE, shell escape, path traversal в args?

Tool abuse — LLM в args function call'а генерирует malicious payload: http://169.254.169.254/... (SSRF к AWS metadata), ; rm -rf / (RCE), ../../../etc/passwd (path traversal), ' OR 1=1-- (SQLi). Defense-in-depth: (1) schema validation через zod / pydantic + allowlist (URL schemes, regex paths); (2) sandboxing — gVisor / Firecracker microVMs / Docker non-root + read-only fs / AWS Lambda; (3) capability tokens short-lived, narrow scope; (4) network egress policies (block 169.254.x.x); (5) HITL approval для destructive tools.