This functionality splits system management tasks among several roles which are quite specific. This in turn guards against an unauthorized user assuming superuser rights. Administrators will need to log in as themselves and then assume one or more roles that they are authorized to perform. This latter step also provides a better way to audit exactly who is doing what on your corporate systems. Also useful for further securing the Solaris platform is Trusted Solaris 8's support for device allocation.
Administrators can set sensitivity labels for specific devices that allow or prevent their use.
Device allocation is supported for both physical hardware attached to the system or software-simulated devices. Even windowing activities can be controlled with Trusted Solaris 8. Administrators might allow users to copy and paste text, graphics, or binary data between windows. The user can preview the data that is to be transferred. But, you can limit access to these capabilitiies, too, and log all activity that occurs between windows.