9. A tangible computer-readable medium encoded with a data structure, the data structure comprising: a base security class that becomes instantiated for use by a shell engine, the base security class having a set of application programming interfaces (APIs) that are called by the shell engine to determine the extent of processing allowed by the shell engine based on a security policy, the set of APIs including a first API to determine whether to pass an object to a command before the object is placed in an input pipe of the command; a default security class derived from the base security class, the default security class including a default set of APIs corresponding set of APIs of the base security class; and a customized security class derived from the base security class, the customized security class to override one or more of the default set of APIs when the customized security policy differs from the default set of APIs.
9. A tangible computer-readable medium encoded with a data structure, the data structure comprising: a base security class that becomes instantiated for use by a shell engine, the base security class having a set of application programming interfaces (APIs) that are called by the shell engine to determine the extent of processing allowed by the shell engine based on a security policy, the set of APIs including a first API to determine whether to pass an object to a command before the object is placed in an input pipe of the command; a default security class derived from the base security class, the default security class including a default set of APIs corresponding set of APIs of the base security class; and a customized security class derived from the base security class, the customized security class to override one or more of the default set of APIs when the customized security policy differs from the default set of APIs. 10. The computer-readable medium of claim 9 , wherein the set of APIs include at least one method out of the set comprising: a second method that when executed determines whether an assembly associated with a command should be loaded; and a third method that when executed determines whether the command should be run.