Yes, and Wasm's capability based security model makes sense for adding plugins to your app. But TFA is intended for running entire apps, so I think letting the

Yes, and Wasm's capability based security model makes sense for adding plugins to your app. But TFA is intended for running entire apps, so I think letting the user of the app control fs and network access via the already widely supported and proven method of CGroups and namespaces is a much better option than whatever method each individual app comes up with.