Applications that handle sensitive information need to express and reason about the trust
relationships between security principals. Such reasoning is difficult because the trust
relationships are dynamic, and must thus be reasoned about at runtime when discovering
and reasoning about trust relationships might inadvertently reveal confidential information
and be subject to manipulation by untrusted principals. The Flow-Limited Authorization
Model (FLAM) by Arden et al. exactly meets these needs. However, previous attempts to use …