Harness defaults to access closer to the working directory level; operation-approval prompts are not equivalent to a sandbox, and network and process visibility are not fully isolated