For example, if we multiply two integers, the product's label must reflect the labels of both operands. Note that L 1 L 1 L 2 for all labels L 1 and L 2 . Joining is a restriction and therefore it does not leak information. The Principal Hierarchy To allow compile-time analysis, slots must be immutably labeled. In practice, these different principals are used quite differently, and many systems treat them as entirely different entities.
Some principals have the right to act for other principals and assume their power.
For example, every member of a group might have the right to act for the group principal. The acts for relation is reflexive and transitive, defining a hierarchy or partial order of principals. We assume that the principal structure can be queried using the primitive acts-for function to discover whether the current principal has the right to act for another principal. The right of one principal to act for another is recorded in a database. Obviously, modifications to the principal structure are extremely powerful and must be restricted by some form of access control.