Rather than listing the unsafe capabilities, assume they're all unsafe unless