Tizen's new access-control broker "Cynara"

They seem to have put a large emphasis on performance. I wonder why Cynara is not a LSM since they would improve performance even more. The model of using SMACK labels for identification, but a user space program for authorization seems less than ideal. It seems obvious to alter SMACK, so it works like they want.