Triggers or controls execution of scripts, command-line tools, or automation components.
Executes local tools, scripts and file operations on the agent's behalf. Broader capability than API calling and correspondingly harder to bound.
Data preparation, format conversion and analysis where the useful operation is a script rather than a service call.
Anywhere the execution environment has access to production systems or credentials. The blast radius of a mistake is whatever the environment can reach.
Execution must be sandboxed with an explicit allowlist of what can be run and what it can reach. An unrestricted shell is not a tool, it is an unbounded capability.
Scope creep in the execution environment. It starts constrained, gains network access for one legitimate reason, and is no longer a sandbox.
An agent normalising a restated settlement file in an isolated container with no network access and no credentials, returning only the normalised output.