Tomorrow: High-level Policy Specification



   Better: Use information-flow control principles. 

Operator specifies intended flow. 
Check against a control graph.

Key Challenge: Specification
(ongoing work)