Protecting The Environment: Safe-Tcl
Dual interpreters (like kernel/user space).
Unrestricted master interpreter (like kernel space) for user and receiving application.
Incoming Tcl script executes in restricted slave interpreter (like user space): no dangerous commands.
Aliases transfer control from slave interpreter back to master interpreter (like kernel calls).