It might be hard or software originating from different companies, or which has to work with components conceived long after its own conception. As is the case for Internet, no central authority keeps track of who is using it and how. Instead, we should look for decentralised and open mechanisms that allow participants in a market to know something about other participants. This should be done without having the participants depend on some central authority, but rather it should be accomplished through the interactions of the participants themselves. We call this family of mechanisms social control .
Hard security is vulnerable if someone finds a way to bypass it.
Soft security permits anything as long as it is good behaving. Social control is a more soft security approach than traditional hard approaches such as passwords, program verification, access control, capabilities etc. Hard approaches demand that you are certain that the components work as intended and if they do so, they will provide a waterproof protection from illegal use. Unfortunately hard mechanisms often fail due to unexpected behaviour of some components. This is what hackers exploit when they use bugs in a mail daemon to gain access to a computer.