What if you have BUILD be a subsystem, and you can configure the subset of extensions that you allow on your BUILD files