POLICY, which is the code's implementation of the intended policy. Ideally, the intended and
implemented policies are the same; otherwise, a vulnerability may exist.
PROTECTION MECHANISM: a behavior or set of behaviors that helps to enforce an intended
security policy for the product (or an associated actor). This is also called a "control" or