Section 11.3.3 does not specify in what order paths added through sandbox commands are searched: what happens if I do addwrite /foo; adddeny /foo/bar; addpredict /foo/bar/baz; touch /foo/bar/baz and what if I change the order in which I call the functions? Does the most recently added matching path win, the most specific path win, or something else?
This is up to sandbox, rather than us. I'd argue that it's beyond the scope of the specification.
as long as sandbox isnt forked, i dont think we need to document these things in PMS ...
