Agreed, deterministically bounding permissions is the way. I don't know how this is not the first approach that people take.