for and nothing else.
u The system should be designed to tolerate security violations.
u The designer should make weak assumptions.
u The system should not cause security problems for other systems in the