Does this consistently work for you? I have something like this plus some commands that are explicitly in a deny list in the harness. Roughly twice a week, the model manages to run the deny listed commands, that I need afterwards to manually revert.