I think answer in this day and age, is to invoke Skynet, and give an LLM control of the system. Glue a local model that works without Internet to it, and give it guard rails, and give it a bunch of system instructions defining the rules on what to let though. It wouldn't be perfect, but what system is?