Checked privilege