Yes aegis capa question, only allow unknown origin capas. Or entries that use capas that cannot be gained without abusing the system like unrestricted system-ui or led notification would need....