1. A computing device, comprising: one or more processors; and one or more machine accessible storage media having embodied therein a policy arbitration system and a plurality of independently executable domains executable by the one or more processors, wherein: the policy arbitration system is executable to manage access to one or more shared system resources by the plurality of domains; each of the domains has a domain-specific policy that is unknown to the other domains; and the policy arbitration system is executable to determine and enforce a least-restrictive combination of the domain-specific policies that enables the plurality of domains to execute on the computing device without violating the domain-specific policies of any of the domains.