of course, we'd end up with tooling to automate the generation of the allowlist, but I imagine that it would end up being like firewall connection alerts.

> The foo/bar module has added three new facts, would you like to allow them to pluginsync?
- facts.d/foo.ps1
- facts.d/bar.sh
- facts.d/baz.py