taint enforce: file access backstops