Reference Monitor

Implement a reference monitor for [parameter] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.