Like you say, the only way to stop it from doing something is to make it impossible for it to do so. Shove it in a container. Build LLM safe wrappers around the tools you want it to be able to run so that when it runs e.g. `git`, it can only do operations you've already decided are fine.
I touch on this a bit in the piece I wrote for normies, it helped a lot of people I know understand the tech a bit better.
Why are permissions for these "agents" on a default allow model anyway?
It's on the people then, not the "agent". But why doesn't Claude come with a decent allow list, or at least remember what the user allows, so the spam is reduced?
However "Telling" has made it better, and generally the model itself has become better. Also, I've never faced a similar issue in Codex.
