It is better to proceed cautiously and implement policies that tend to be more restrictive as opposed to dumping in features. The more features that are added, the more difficult it is to maintain security. Or, the easier it is to break security. Whatever your policy, document it well . Each security policy should carefully document the capabilities that it provides.
Known weaknesses are especially important to document.
All this information is important to applet designers, and to system administrators. The former want to work around problems. The later need to judge the safety of using your policy. Implement policies in Tcl, not C . The preferred method to providing security is to completely remove unsafe commands and replace them with aliases implemented in Tcl.