Good question! Deno has four policies that I know of: --allow-write --allow-net --allow-env --allow-run Today these policies are all-or-nothing and th

Good question! Deno has four policies that I know of: --allow-write --allow-net --allow-env --allow-run Today these policies are all-or-nothing and they are global to the entire Deno process. Consider and application which _only_ needs to make a GET request to a single GitHub API endpoint. This application will then use the `--allow-net` flag and will be able to communicate with arbitrary sites like evil.ru. However, with Osgood, the permissions are much more granular. One can specify a policy to only get access to _exactly_ what is needed. The permissions are also granular enough to only apply to a subset of the overall application: app.route('GET', '/gh/:username', 'gh.js', policy => { policy.outboundHttp.allowGet('https://api.github.com/users/*/gists'); }); We will add further policies where it makes sense, such as with filesystem access. However, Osgood doesn't aim to be a _general_ platform for running code, so we will likely expose filesystem access in a manner akin to this: https://thomashunter.name/presentations/introducing-osgood/#/39 https://thomashunter.name/presentations/introducing-osgood/#...