In my experience, Allowlists are not deterministic because the #1 thing the LLM does is write python scripts nearly every prompt and ask permission to execute its latest script. I know of no developers who review that code since it would make the process too slow to be useful. So YOLO! Yes, Claude/Codex/Gemini, you can execute the python you just wrote, even though I didn't review it and you have access to the entire machine and so every command I didn't give permission to execute you could just have written the equivalent python.