You'd just invert it. Make it so you have to be approved under export controls as a customer like they were gonna do for mythos (and like how mythos sort of still works) and make it an allowlist instead of a denylist