"data flows in Qubes OS seem to be currently loosely defined or discretionary at best (it is up to the user to move data among domains and there are no hard rules of what can and cannot be accessed and/or copied to/from different level security domains)."
This is a problem. As Vista showed, if you bother the user with too many details, they'll just open it up wide open and let everything through so they can just get their work done.