Devlin, could you comment on this or re-assign as appropriate?  If it is a quick fix, we might want to hold off on landing the blocking bug until this gets resolved.  Thanks.

From a high level, I'm not opposed to this, and can see the potential benefit (though I doubt it will be widely used).  However, it won't be a trivial change, and it's probably not something that I (or anyone on my team) will have the bandwidth to handle in the near future.

Also +raymes@ for content settings expertise, in case he has opinions.

I think separating permissions would be a reasonable step. 

I've expressed this before but I think that we should actually deprecate this API and have a more thought-out API. The API is very complicated with subtle semantics in how patterns interact with other patterns and so on. It also doesn't work well for sensitive permissions.