I'd originally thought of allowing policies to be influenced by
arbitrary code. But that may be overkill:
- it's probably not a good idea to allow policies to read/write from file system
- it's even less a good idea to allow policies to access the network
- particularly since it's difficult (error-prone) to distinguish GET/POST in arbitrary protocols
- once you allow file system and network, you're pretty close to owned
So let's first focus on the simplest policy, the one that is easiest to
secure. We'll add capabilities to policies as we gain confidence we can
secure them.
