Allow a domain for this applet; maps to the kehto capabilities that domain needs.
Domains the shell can offer at all in the current configuration.
Domains granted automatically to every applet. In kernl this is the read-only, no-network set.
Make sure the runtime ACL reflects this applet's record; returns the record.
Withdraw a domain; live sessions lose it immediately.
The grants surface plus the hook the shell calls when an applet is about to run.