@stefano The part that bites is handing anything, human or AI, live creds with no rollback. Any firewall change on a box you're remote into should ship with a scheduled revert, like a timed reload that undoes it unless someone confirms. Cheap insurance for the days there's no separate VPN jail to save you.