This section describes our new model of decentralized information flow. The model assumes a set of principals representing users and other authority entities. To avoid loss of generality, a process has the authority to act on behalf of some set of principals.
Computations manipulate values .
A value can be written either to a slot or to an output channel , which serves as an information sink that transmits data outside the system. Values, slots, and channels all have attached labels , which are a more flexible form of the security classes encountered in most information flow models. The flexibility introduced by our labels makes decentralized declassification possible. The label on a value cannot change, but a new copy of the value can be created with a new label. When this happens we say the value is relabeled , though it is really only the copy that has a new label.