Learnings and mistakes securing my agent with nvidia’s openshell.