That's actually what I meant by navigating links. Each page would load fresh content that might have plugins that require services not authorized in the main ap

That's actually what I meant by navigating links. Each page would load fresh content that might have plugins that require services not authorized in the main app. For example, any typical RSS reader, alternative email clients, specialized browsers, or any dev tool that shows page previews using a webview. These all have to max out the entitlements so they don't break down the line. It seems like it would be much more useful to make entitlements be a dynamic system instead, so apps can request extra privileges at runtime and asking the user to confirm instead of statically baking it into the app envelope. Same goes for the iPhone.