new rules for all sorts of privileged and certified APIs