Placeholder task no to forget, as we don't have a policy hook in place for restricting access to the agl_shell_desktop (could also add one agl_shell as well, but this is another talk). 

I suppose the hooks should contain some API functionality to allow reading config.xml files to make the actual decision.