Of course there is a wide range of policies that can be used, and they each have tradeoffs between security and restricting legitimate program actions. We've found some simple policies that work quite well in practice, allowing nearly all programs to run unhindered, while stopping many security attacks. We don't need to be too aggressive here because we have other techniques that can be combined with code origins, and the end result provides strong security with very few false positives.