[simonw]

That looks like exactly the level of control I've been hoping for in terms of sandboxing. This is really promising!