Trusted Types just gives you the APIs for declaring what code is allowed to make strings that may be used with unsafe sinks. You could do this by validating in

Trusted Types just gives you the APIs for declaring what code is allowed to make strings that may be used with unsafe sinks. You could do this by validating inputs with regexes, or you could make a safe-by-construction API, or you could not declare certain methods on your policies and thereby ban entire classes of unsafe API from your page. The key idea is to have a small number of places that declare policies and generate trusted values. You can then audit just those places, because you know that all writes to unsafe DOM sinks must pass through those policies.