It isn't clear from the materials, but is a capabilities based security model being put in place .. similar to WASI? .. or is it just the beginnings of one with blanket `--allow-read`, `--allow-net` and such.