How can the permissions mechanism be fine grained enough to prevent bad random things, and coarse grained enough that you can understand it?