A method for configuring, in an electronic device, a target domain (50-T) of a hierarchical chain of trust, the target domain (50-T) providing a cryptographic identity (52-T) for authenticating commands to be executed by the electronic device, the method comprising: receiving a domain configuration command requesting configuration of the target domain (50-T) on the electronic device, the domain configuration command specifying at least one target domain constraint to be satisfied by commands to be authenticated by the target domain (50-T) and at least one target domain future constraint to be combined with other constraints when configuring a descendant domain of the target domain; authenticating the domain configuration command based on a cryptographic identity (52-A) provided by an authenticating domain (50-A), wherein the target domain (50-T) is a descendant domain of the authenticating domain (50-A) in the hierarchical chain of trust; and when the domain configuration command is authenticated: combining, using one or more logical functions, said at least one target domain constraint and at least one future constraint (82-A) specified by the authenticating domain (50-A) to generate a combined constraint set (80-T) comprising zero, one or more constraints to be satisfied by commands to be authenticated by the target domain (50-T), and storing an indication of said combined constraint set (80-T), and combining, using one or more logical functions, said at least one target domain future constraint and said at least one future constraint (82-A) specified by the authenticating domain (50-A) to generate a combined target domain future constraint set (82-T) comprising zero, one or more constraints to be combined with other constraints when configuring a descendant domain of the target domain, and storing an indication of said combined target domain future constraint set (82-T), wherein the term target domain constraint refers to requirement(s) to be satisfied by commands in order to be authenticated, and wherein the term future constraint (82-A) refers to requirement(s) to be satisfied by commands authenticated by descendant domain(s) of the authenticating domain (52-A). receiving a domain configuration command requesting configuration of the target domain (50-T) on the electronic device, the domain configuration command specifying at least one target domain constraint to be satisfied by commands to be authenticated by the target domain (50-T) and at least one target domain future constraint to be combined with other constraints when configuring a descendant domain of the target domain; authenticating the domain configuration command based on a cryptographic identity (52-A) provided by an authenticating domain (50-A), wherein the target domain (50-T) is a descendant domain of the authenticating domain (50-A) in the hierarchical chain of trust; and when the domain configuration command is authenticated: combining, using one or more logical functions, said at least one target domain constraint and at least one future constraint (82-A) specified by the authenticating domain (50-A) to generate a combined constraint set (80-T) comprising zero, one or more constraints to be satisfied by commands to be authenticated by the target domain (50-T), and storing an indication of said combined constraint set (80-T), and combining, using one or more logical functions, said at least one target domain future constraint and said at least one future constraint (82-A) specified by the authenticating domain (50-A) to generate a combined target domain future constraint set (82-T) comprising zero, one or more constraints to be combined with other constraints when configuring a descendant domain of the target domain, and storing an indication of said combined target domain future constraint set (82-T), combining, using one or more logical functions, said at least one target domain constraint and at least one future constraint (82-A) specified by the authenticating domain (50-A) to generate a combined constraint set (80-T) comprising zero, one or more constraints to be satisfied by commands to be authenticated by the target domain (50-T), and storing an indication of said combined constraint set (80-T), and combining, using one or more logical functions, said at least one target domain future constraint and said at least one future constraint (82-A) specified by the authenticating domain (50-A) to generate a combined target domain future constraint set (82-T) comprising zero, one or more constraints to be combined with other constraints when configuring a descendant domain of the target domain, and storing an indication of said combined target domain future constraint set (82-T), wherein the term target domain constraint refers to requirement(s) to be satisfied by commands in order to be authenticated, and wherein the term future constraint (82-A) refers to requirement(s) to be satisfied by commands authenticated by descendant domain(s) of the authenticating domain (52-A).