You Cannot Trust Your Agent (and How to Isolate It)

How do you prevent an autonomous, powerful AI agent from looking at your secrets, reading unrelated projects, or even accessing sensitive files outside the scope of the project you asked it to work on?