I'm not so sure anymore that it's trivial to write this single-job interface without security holes.