Building a trusted computing base
SetUID Programs as a classic example of "confused deputy"
examples: compiler, ftpd with subshell etc.