> or cannot control any of the inputs to the llm
Seeing as LLMs are non-deterministic, I think even this is not enough of a restriction.