a third sphere might be "users who are authenticated to the operating system on which the
product is installed." This control might be implicitly defined through OS-layer permissions.
Each control sphere has different sets of actors, resources, and allowable behaviors.
Weaknesses and vulnerabilities can arise when the boundaries of a control sphere are