[nmca]

systems level - so if, for example, I can have two services or serverless functions, one of which can access the world and the other of which cannot see, for example, the pii tables.

(I'm not a production customer, and I haven't thought through how this ought to work in deno-deploy-land, I've just seen a lot of painful ACL set ups. But I also like knowing that lambda function foo written by the intern can't read every DB table)