This is one compaction away from being truncated to "allowed examples: `git add`...". System prompts aren't safeguards. A step in the right direction is auto-

This is one compaction away from being truncated to "allowed examples: `git add`...". System prompts aren't safeguards. A step in the right direction is auto-review, available in claude-code, codex, and Cursor products. This is not foolproof either. This is why remote calls should be gated through an MCP or other API gateway. The MCP can restrict calls even when the provider lacks scoped privileges for their integration keys.