Sounds like a good criterion - until that tool becomes scriptable.

the new codegen world requires new security considerations. At work I shipped an endpoint that executed raw SQL provided as input. Its the legacy textbook what not to do, but AIs work better with that kind of interface so we have to adapt and figure out how to secure it. In our case its put the SQL planner (duckdb) inside a lambda with security provided by IAM policies, and unbounded CPU execution guarded by the lambda runtime itself. We need to adjsut how we secure things to deliver safe expressive interfaces but those interfaces are needed, otherwise we hold back the productivity of the users of those interfaces. Everything will be codegen soon, its tricky but not impossible to secure.