Hey, I know what’s the problem is 
The framework needs 2-3 (or even 20-30) ‘reference apps’ so that it is really stays up to its purpose. Probably it already has behind the scenes (high paying customers on Galaxy).
Otherwise all this theoretical talk is similar to “how to educate a kid” - with single truth “allow/deny list” or with explaining that in each of methods he or she has… what are the users he/she will interact with? are they good and will not try to abuse him/her? But we have only simple to-do kid, zygote, not even embryo and trying to predict his/her behaviour in university.