anchor.diff:  sandboxing implementations can be developed by using this white listing model and extending from the
   `AbstractSandboxExtension`.
   
  -A final thought on the topic of `CompilerCustomizerProvider` implementations is that they are not just for
  -"security" (though they are demonstrated in that capacity here).  They can be used for a variety of features that
  +A final thought on the topic of `GroovyCompilerGremlinPlugin` implementation is that it is not just for
  +"security" (though is is demonstrated in that capacity here).  It can be used for a variety of features that
   can fine tune the Groovy compilation process.  Read more about compilation customization in the
   link:http://docs.groovy-lang.org/latest/html/documentation/#compilation-customizers[Groovy Documentation].
   
  
positive.code: gremlin> :> while(true) { }
  Execution timed out after 10000 units. Start time: Fri Jul 24 11:04:52 EDT 2015
  
  There are a number of pre-packaged `CustomizerProvider` implementations:
  
  [width="100%",cols="3,10a",options="header"]
  |=========================================================
  |Customizer |Description
  |`CompileStaticCustomizerProvider` |Applies `CompileStatic` annotations to incoming scripts thus removing dynamic dispatch. More information about static compilation can be found in the link:http://docs.groovy-lang.org/latest/html/documentation/#_static_compilation[Groovy Documentation].  It is possible to configure this `CustomizerProvider` by specifying a comma separated list of link:http://docs.groovy-lang.org/latest/html/documentation/#Typecheckingextensions-Workingwithextensions[type checking extensions] that can have the effect of securing calls to various methods.
  |`ConfigurationCustomizerProvider` |Allows configuration of the Groovy `CompilerConfiguration` object by taking a `Map` of key/value pairs where the "key" is a property to set on the `CompilerConfiguration`.
  |`ThreadInterruptCustomizerProvider` |Injects checks for thread interruption, thus allowing the thread to potentially respect calls to `Thread.interrupt()`
  |`TimedInterruptCustomizerProvider` |Injects checks into loops to interrupt them if they exceed the configured timeout in milliseconds.
  |`TypeCheckedCustomizerProvider` |Similar to the above mentioned, `CompileStaticCustomizerProvider`, the `TypeCheckedCustomizerProvider` injects `TypeChecked` annotations to incoming scripts.  More information on the nature of this annotation can be found in the link:http://docs.groovy-lang.org/latest/html/documentation/#_the_code_typechecked_code_annotation[Groovy Documentation].  It too takes a comma separated list of link:http://docs.groovy-lang.org/latest/html/documentation/#Typecheckingextensions-Workingwithextensions[type checking extensions].
  |=========================================================
  
  To provide some basic out-of-the-box protections against troublesome scripts, the following configuration can be used:
  
  [source,yaml]
  scriptEngines: {
    gremlin-groovy: {
      imports: [java.lang.Math],
      staticImports: [java.lang.Math.PI],
      scripts: [scripts/empty-sample.groovy],
      config: {
        compilerCustomizerProviders: {
          "org.apache.tinkerpop.gremlin.groovy.jsr223.customizer.ThreadInterruptCustomizerProvider":[],
          "org.apache.tinkerpop.gremlin.groovy.jsr223.customizer.TimedInterruptCustomizerProvider":[10000],
          "org.apache.tinkerpop.gremlin.groovy.jsr223.customizer.CompileStaticCustomizerProvider":["org.apache.tinkerpop.gremlin.groovy.jsr223.customizer.SimpleSandboxExtension"]}}}}
  
  NOTE: The above configuration could also use the `TypeCheckedCustomizerProvider` in place of the
  `CompileStaticCustomizerProvider`.  The differences between `TypeChecked` and `CompileStatic` are beyond the scope of
  this documentation.  Consult the latest link:http://docs.groovy-lang.org/latest/html/documentation/#_typing[Groovy Documentation]
  for information on the differences. It is important to understand the impact that these configuration will have on
  submitted scripts before enabling this feature.
  
  NOTE: The import of classes to the script engine is handled by the `ImportCustomizerProvider`.  As the concept of
  "imports" is a first-class citizen (i.e. has its own configuration options), it is not recommended that the
  `ImportCustomizerProvider` be used as a configuration option to `compilerCustomizerProviders`.
  
  This configuration uses the `SimpleSandboxExtension`, which blacklists calls to methods on the `System` class,
  thereby preventing someone from remotely killing the server:
  
negative.code: Protecting Script Execution
  +++++++++++++++++++++++++++
  
  It is important to remember that Gremlin Server exposes `GremlinScriptEngine` instances that allows for remote execution
  of arbitrary code on the server.  Obviously, this situation can represent a security risk or, more minimally, provide
  ways for "bad" scripts to be inadvertently executed. A simple example of a "valid" Gremlin script that would cause
  some problems would be, `while(true) {}`, which would consume a thread in the Gremlin pool indefinitely, thus
  