.NET DLR and SecurityException's

DLR需要哪些强制性PermissionSet项才能正常工作?

我们已经在沙盒脚本环境中启用了DLR。但是像下面这样的代码…

dynamic foo = someobject
foo.FooBar();

…只是导致抛出一个相当模糊且看起来"未完成"的异常，如下所示:

System.Security.SecurityException: Request failed.
   at CallSite.Target(Closure , CallSite , Object )
   at System.Dynamic.UpdateDelegates.UpdateAndExecuteVoid1[T0](CallSite site, T0 arg0)
   at AcmeCorp.AcmeRocket.Workflow.Scripting.Assemblies.WorkflowScriptImplementation.Test()
   at AcmeCorp.AcmeRocket.Workflow.Scripting.Assemblies.WorkflowScriptImplementation.__action_activity_4397110c5d7141a6802a070d3b942b77()
   --- End of inner exception stack trace ---
   at AcmeCorp.AcmeRocket.Workflow.Scripting.WorkflowScriptProxy.Invoke(String method_name)
   at AcmeCorp.AcmeRocket.Workflow.Execution.Executors.ActionActivityExecutor.Execute(WorkflowInstance wi, ActionActivity activity)
   at AcmeCorp.AcmeRocket.Workflow.Execution.ActivityExecutorBase.Execute(WorkflowInstance wi, Activity activity)
   at AcmeCorp.AcmeRocket.Workflow.Execution.WorkflowExecutor.ExecuteActivity(WorkflowInstance wi, Activity activity)
   at AcmeCorp.AcmeRocket.Workflow.Execution.WorkflowExecutor.Execute(WorkflowInstance wi, Nullable`1 branch_index)

通常情况下，SecurityException包含大量详细信息，精确地指定哪些权限导致它失败，但在这种情况下，我们没有得到这些-非常烦人。

PS:如果我用我们的沙盒暂时授予PermissionSet(PermissionState.Unrestricted)运行相同的测试，那么问题就会消失。但是很明显，我们真的想把它锁定在DLR需要的一组非常特定的权限上。

PPS:当前(失败的)PermissionSet创建如下:

var ps = new PermissionSet(PermissionState.None);
ps.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));
ps.AddPermission(new ReflectionPermission(ReflectionPermissionFlag.RestrictedMemberAccess));

谢谢。