... 1 Introduction In situations where a program P interacts with one or more untrusted program components U, a well-specifiedaccess control policy protects P 's resources from unwanted operations performed by U.Systems such as Java and the Common Language Runtime (CLR) provide a mechanism for defi ...