Then again, any program that in any way starts another binary (or several) would always end up having to pledge the sum of all possible child permissions, so it

Then again, any program that in any way starts another binary (or several) would always end up having to pledge the sum of all possible child permissions, so it would just mean that any such program (like sudo) would just not be limited at all just so it can run both ls and reboot, when the setuid sudo program would be just the kind of program you would like to have pledged so that it doesn't talk net when it shouldn't or does other out of line weirdness.