enforce least-privileged access to commands, data, con fi guration, machine-learning models, and software updates that are fl owing, as messages, between its distributed parts. We can build applications that have a strikingly smaller vulnerability surface.