.agentignore/.agentnotallowed file

force agents to not touch mission critical things, fail in CI otherwise

let it work on frontends and things at the frontier of the dependency tree, where it is worth the risk

a) what happens if there is change that hasn't been encountered yet so it's not in .agentnotallowed? b) is there a guarantee that something described in these files won't be touched? I've seen examples when agents directly violate these rules, profusely apologising after they get caught on it.