Allow a domain for this applet; maps to the kehto capabilities that domain needs.
Domains the shell can offer at all in the current configuration.
Domains granted automatically to every applet. In kernl this is the read-only, no-network set.
Withdraw a domain; live sessions lose it immediately.
User-facing grant operations. Everything here is per applet identity and reversible.