I think that org-eval-light.el could even replace org-eval.el if -light- had an option to eval automatically all code snippets when you open a file. This way it would act like org-eval and at the same time it could be made secure.
  It could have a setting „what to do with code when opening a file" with options: „never run", „ask before running" and „run without asking".

  The action of asking whether to evaluate code is similar to Emacs' local variables behaviour.

  Someone suggested using „local variables" to define functions, but:

1. You can only call the defined functions through (funcall 'function). This is bad because you can't control how the current code will call your functions; for instance how org will call org-dblock-write:this-function

2. The section where you define local variables has picky and uneasy rules about handling of line breaks and special characters.


  Therefore I think that org-eval* is needed and that the 2 could be combined.
 
-- Daniel