How do you restrict agents from introducing random 3rd-party packages?

I explicitly asked an agent to write a lightweight helper function for formatting dates. Instead of using built-in JS utilities or our existing setup, it tried to npm install a obscure library just to parse a string.

It feels like agents often default to importing heavy external package for trivial logic rather than writing 5 lines of clean native code.

What’s your strategy for enforcing a zero new dependencies policy without micro-managing every single prompt?