Control is the wrong target. Bounded permissions, full logs, and a hard kill switch matter more than pretending the model is predictable.