I think the philosophy is that the trust boundry is your host, not your uid. We seem to be migrating towards "one instance per application" from of the traditi

I think the philosophy is that the trust boundry is your host, not your uid. We seem to be migrating towards "one instance per application" from of the traditional "one uid/proc per application". For the great majority of use cases this is going to be the simpler, and safer assumption.