oh-my-pi has pretty poor permission system in my experience. Either yolo or deny/approve everything. No classifier, no sandbox.