1. Background
For security point of view, AGL would need frame work to grant access right to system resources.
A window
A Audio sink
A file system
,,,,,

2. Proposal) manifest file per application
Application defines system resources it requires in manifest like Android.
Application frame work, AFW, verifies signature or other way of install package of application.
If verified, AFW grants access right on installed application.
E.g.
It can create a window with surface ID.
It can output audio to a alsa sink.
,,,,,