What I'm looking for is a language that includes, in the language, a
security model, with a full notion of an `agent' that operates on the
behalf of a `user', `group', or `service', where procedures are
exported, can examine the identity of the user on whose behalf they
were called, can dynamically or statically declare which operations
are available to which classes of users, or operate conditionally
depending on whose behalf they were called, and where there is no way
to cheat, since the agent is signed by the user securely. I don't see
this in Safe-TCL. The language doesn't have any simple way to
determine whose authority a procedure executes with. Maybe Safe-TCL is
a useful platform on top of which one could build this kind of
security model, but it isn't there, and it isn't obvious that Safe-TCL
actually provides 'an open framework on which you can build' such
applications.