For people we use techniques such as non-disclosure agreements, background checks, and audit trails. For programs we perform security audits. Since auditing every program we run is unfeasible, so we really want to limit the number of programs we need to audit. An additional set of problems occur when programs have authority which their users do not have. The common technique for protecting the integrity of databases produces this situation.
Users have authority to invoke certain database transactions which ensure the rules are followed.
The transactions in turn have the authority to read and write the database. The kludges systems implement to support this requirement are responsible for what Norm Hardy calls the Confused Deputy Problem . The program instance has the authority, but it doesn't know whether it is from the user or associated with the program. As a result, the user can persuade the program to miss-use its authority. A solution to the problem of programs running with all the user's authority is to create a new security domain for the program instance, and give it only the authority it needs to do its job.