I put my agents In a all vm network that can only access the internet through a VPN. Full control, no permissions, git is the source of truth, and I rebuild the entire network from scratch with nixos periodically. Nested virtualization is really nice for this too.