"Just use a deny list" is the other obvious response. You could. You'd need to write every rule yourself, maintain it, and accept that string-matching rm -rf will flag git commit -m 'fix rm -rf bug' as dangerous. Plus, this enables shared rules across our company’s engineers/teams