> I don't honestly believe that the allowlist isn't (naively) intended to be there for security. It's certainly not a very useful ux for providing LLM guidance: prompts, memories & AGENTS.md already provide an avenue for this & having it in a formalised, structured format isn't conducive to LLM guidance.

If you had any experience with using LLM harnesses, you would be aware that despite instructions (in prompts, AGENTS.md, etc.) the agents will sometimes ignore those instructions.

One solution to remind the agents is to explicitly disallow their instruction-violating attempts.

This is how allowlists are used to guide agent behavior.

You should try it sometime before you speak authoritatively about it further.