access level necessary. First identify the different permissions that the software and its
users will need to perform their actions, such as file read and write permissions, network
socket permissions, and so forth. Then explicitly allow those actions while denying all
else [R.250.2]. Perform extensive input validation and canonicalization to minimize the