While that seems like a somewhat sensible approach for non-technical end users (modulo various kinds of runnable scripts), a whitelisting approach can't possibly work in an organization doing software development.

I can't think of any technological approach that would work in such an organization, short of completely redesigning end-user client systems.