Principal, DC labels, and privileges