FROM: The user must be sure that his actions have predictable consequences, even in the presence of actively hostile influence. If there is a component in the system that the user can not control, the user must be able to contain its impact, either by simply ignoring it (shielding), or by imposing restrictions (confinement). _Security means that the user controls what can happen **to** his resources._ -- [[TomBachmann]] - 29 Apr 2006