application. The formal top-level specification (architecture design) was derived
from the functionality defined in the user requirements, constraints identified in
the formal security policy model, and results from the prototype user interface.
Praxis used a type checker to automatically verify the syntax in the formal