Accountability

In the event that the user has granted trust to a program which then abuses that trust, logging mechanisms will be necessary to prove that damages occurred and then seek recourse.

In each system, the interposed protection code can always record what happened, but it requires more effort to identify the principal responsible.

In the stack introspection system, every call to enable a privilege can be logged; an administrator can learn which principal enabled the privileges to damage the system.

In a capability system, a capability can remember the principal to which it was granted and log this information when invoked. If the capability can be leaked to another program (see section 4.3), the principal logged will not be the same as the principal responsible for using the capability. A modified capability system would be necessary for strong accountability.

With name space management, information about principals is not generally available at run-time. This information could possibly be associated with Java threads or stored in static variables behind interposed classes. Likewise, capabilities could store a principal in a private variable.

This is all hypothetical, unfortunately, since current browsers do not provide the tamper-resistant logging necessary for trustworthy auditing. Once available, any of these architectures should be able to use it.