This still work in progress.

This MR is mostly ideas so I can discuss with @romain over some specific redesigns over allocation scope and security.