They aren't. Allowlists are a deterministic tool. That's the whole point: instructing an llm to review itself is nondeterministic, and thus not a good tool for permissions, compared to allowlists, which are.