OneCLI: Give every employee a secured, sandboxed pro assistant agent