Right, so then sudo could conditionally pledge things based on what its ACL says. And that whitelist would apply to the program it starts. I&#x27;d understand there being &quot;temporary&quot; pledges, where it gets reset on exec, but I don&#x27;t understand making it by default temporary.