An alias is a command in the untrusted interpreter that is really implemented by a different, fully trusted interpreter. In Safe-Tcl, an untrusted script is isolated in its interpreter context, and given a few extra commands that are carefully implemented by another Tcl intpreter to ensure safety. When creating a security policy, there are a number of high-level principals to keep in mind. Safe-Tcl supports multiple policies . We explect there to be a family of security policies used with Safe-Tcl.
Additional policies provide non-trivial functionality to applets that is still safe, to some degree.
Lean towards security and away from features . The mechanisms of Safe-Tcl let us construct any policy. It is better to proceed cautiously and implement policies that tend to be more restrictive as opposed to dumping in features. The more features that are added, the more difficult it is to maintain security. Or, the easier it is to break security.