Read-only OM files#

TODO

Backward Sandboxing Per-plugin isolation Forward