Safety & Permissions

The narrowest useful authority should be granted for the shortest useful period.

Control points

Separate discovery from execution, read from write, reversible from irreversible, and delegated identity from end-user identity.