not properly enforced, or when a control sphere is defined in a way that allows more
actors or resources than the developer or system operator intends. For example, an
application might intend to allow guest users to access files that are only within a given
directory, but a path traversal attack could allow access to files that are outside of that