From my time working with SELinux on the desktop I'm curious to see what they do with it eventually, now running it in permissive audit mode doesn't do much at

From my time working with SELinux on the desktop I'm curious to see what they do with it eventually, now running it in permissive audit mode doesn't do much at all. I'm wondering if the plan is to eventually have each app ship with a policy file (doubt it)? Use a targeted policy to only confine certain apps chosen by the user with corresponding policies and run everything else unconfined (minimizes breakage)? Run the entire dalvik vm in a separate confined domain? Just leave it there as an option for enterprise and government customers who would really take advantage of flexible interface for writing access policies?