mechanism is correct if its implemented control sphere is the same as the intended
control sphere for that protection mechanism. A mechanism has a vulnerability if its
implemented control sphere subsumes the intended control sphere. The mechanism is
unnecessarily restrictive if it is a proper subset of the intended control sphere -