A subsystem to restrict programs into a “reduced feature operating model”
This won't work for programs that allow for plugins, which are arguably those that need the most protection. Programs don't generally know what permissions plugins when they are compiled.