Using LLMs to Author Security Controls, Not Enforce Them

Should an LLM decide whether a commit is safe? Should it approve a deployment, block a change, or grant access?