I just found something intriguing which Microsoft really ought to take a look
at. It's a desktop called CapDesk, which implements capability security, but
provides a nearly transparent experience for the user - no administration
burden.
http://www.combex.com/tech/edesk.html
I hope WinFS can do something like this - if not, maybe Microsoft can
include it in the next version? Embrace-and-extend time, folks!
- Lyle