Have the AI write two files: a short wrapper you read and approve, and a Deno script that runs with only the permissions the wrapper grants. What that protects against, what it doesn’t, and why --allow-run breaks it.