Very cool. I was recently thinking about how a social trust graph could possibly be used to augment reviews of lavamoat policy files (e.g. if dependency X uses a global, but a project I trust disallows such uses via lm policy, I could use that info when reviewing a lm policy change involving X)