Per-plugin isolation#

TODO

Backward Read-only OM files Permissions Forward