you should be able to deny it though, yea? (not common, I use this for certain subagents)

ideally that should look more like enforced preflight by the plugin system