> But to me the challenge is that it’s hard to imagine everything that needs to be preemptively captured and prohibited. I have to imagine this stuff for living, and I literally did not think anyone would just move a mouse pointer like this.

In requirements engineering, you do only codify things in the positive sense. The reason behind is that the system shall only do things that are described. If there are no things described, the system shall do nothing.

You can forbid a lot of things, but then you would have pages upon pages of requirements telling you things you may not even wanted implemented in the first place.