1. Application—Access control mechanisms may be provided at this level
to implement complex security policies involving third-party trust
establishment, user authorization, etc.
2. Middleware—Application frameworks (such as .NET and Java Enterprise