A data-analysis agent runs model-written Python in a container on the application host. So the code can query data, the container inherits environment variables that include read-write production database credentials, and it has open network egress. Security review blocks launch. Which change best fixes the risk?

1. A Add a static-analysis pass that blocks dangerous imports such as os, subprocess, and socket before any generated code executes.
2. B Have the model review its own code for destructive or exfiltrating operations and refuse to submit anything that looks unsafe.
3. C Run code in an isolated sandbox with no secrets and no default egress, feeding data via host-staged files or a scoped read tool.
4. D Swap the credentials for a read-only database user but keep network egress open so the code can still install needed libraries.