That'd require some sort of sandbox, which they already seem to not want to have, for whatever reason. If you don't want that, and you want to use JS, building any sort of permission system on top of that that you cannot easily work around, gets really tricky if not impossible.