Building a trusted computing base
confused deputy problems and why designation separated from permission