User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems
Design of the EROS trusted window system