<aegis>

  <request policy="add not-inheritable">
        <credential name="applauncherd-launcher::access"/>
    	<for path="/usr/bin/invoker" id="client"/>
  </request>

</aegis>
