You already do the hard part of this. You authenticate your production APIs. You treat anything from the public internet as hostile until proven otherwise. And after a year of prompt-injection write-ups, you already assume an agent can be steered by the text it reads. There is one spot almost everyone exempts from those rules: localhost. The service bound to loopback gets a pass, because for twenty years "it only listens on localhost" meant "an outsider cannot reach it." Microsoft's AutoJack ...