it's good, but not exactly how I want it done. Namely, it's not hierarchical. E.g. I can say Site A may load frames from site B. But then site B tries to load stuff in its frame and I have to set additional rules for Site B. instead an forward pointer to "Site B default inclusion set" or something like that would be useful.

Basically, hundreds of sites embed youtube. And on some (but not all) I simply want to apply a "load the minimal amount of stuff necessary to embed youtube" rule. If loads are conceptualized as a tree (A loads B loads C) a flat matrix is not powerful enough.