> The fact that this mechanism is so primitive across all agentic clis is frankly a serious indictment of the competence & experience behind LLM-focused development teams.

Not at all. The proper solution to this problem is running in a sandbox - which is not reinvented by the LLM harness because there are already many great options.

You misunderstand the mechanism. It is not intended to provide security. It is intended to guide LLM behavior.