Sandbox privileges applied recursively, minor tweaks