I think the a static interface should be OK? As I understand it the policy will be internal to the mail stuff, so if we need to recompile classes when the interface changes shouldn't matter too much. If we went with dynamic would we not need to compile changes in affected areas anyway to make use of the new permissions?
Since we have the SSL stuff in addition to TLS now, that would need some policies as well.
True, I'm afraid it will become a store of opaque parameters rather than simple attributes... Never could decide.