Simple solution, don't use an indeterministic tool to do things that require deterministic constraints?

They aren't. Allowlists are a deterministic tool. That's the whole point: instructing an llm to review itself is nondeterministic, and thus not a good tool for permissions, compared to allowlists, which are.

	▲	socalgal2 an hour ago \| parent [-]
		In my experience, Allowlists are not deterministic because the #1 thing the LLM does is write python scripts nearly every prompt and ask permission to execute its latest script. I know of no developers who review that code since it would make the process too slow to be useful. So YOLO! Yes, Claude/Codex/Gemini, you can execute the python you just wrote, even though I didn't review it and you have access to the entire machine and so every command I didn't give permission to execute you could just have written the equivalent python.