Looks like an okay approach to me. :+1: as it goes.

I guess the alternative would have been to put the blacklist on the policy level... and then split our policies so that we have two policies for the same decision context. One for the global checks, and a separate one just for the blacklisted-limited check.

Yeah, putting the blacklist onto the policy level would work too. @dcallagh, could you please reivew this one when you get a chance?

This is a package black list, right? As in, we want to exclude certain packages from certain policies/rules.

So isn't this just another case where we want per-package policies? #75

RIght. This is just a temporary solution in the short term until we can get #75 resolved.

Okay. Seems like it would be cleaner to put the blacklist at the policy level. Since that is probably what we will end up with for #75 (in one form or another).

Hmm, actually this PR should go to the pre-release-2017-10-04 branch. I will drop this one and make a new one.

see #94