Is it possible somehow to ask the user to allow cross-domain access instead of a policy file on the target server?
Usage scenario: Silverlight app will communicate with devices and which are on the client's local network, and these devices won't know in advance that a silverlight app needs to talk to them.
Its not a decision the user can make in the security model that Silverlight implements. Its the "owner" of the destination site that should get to choose the policy. There is no way to determine the user is the owner of the destination.
The solution is to use the site that is hosting the Silverlight application as a proxy to access the other services on the clients network.