While my approach is that users would modify the core application itself (even if initially in a sandboxed copy), which would be a lot more powerful, but also a lot more complex, with many more hard questions that would need to be answered, like how to deal with data and security and so on.