Can we just use something like AWS instance roles where the key isn’t even known to the agent? The sandbox is authenticated, the agent running there sends requests, the sandbox middlemans the request to perplexity, which authenticates the sandbox.