the default situation will be to deny all requests that do not explicitly
conform to the conditions under which such requests are permitted.
u Separation of Privilege—A high-assurance or otherwise high-consequence
function should require two keys to unlock it (i.e., to cause its execution).