Troupe enforces information flow dynamically, tracking confidentiality and integrity labels on individual values. The monitor follows dependencies through computation and communication, including dependencies on the progress of a process.
The progress-sensitive baseline follows from the combination of concurrency and untrusted code: a program can transmit information through whether a process sends a message at all. Because strict progress sensitivity is restrictive in practice, Troupe allows a program to release information about its progress, as well as individual values, under explicit authority. Authority can be attenuated before it is passed to another component. These uses of authority are the parts of the program that require careful auditing.
Sandboxing confines untrusted computations by restricting their effects, including message passing and process creation. Time boxing assigns a fixed interval to such a computation, separating the caller’s progress from whether the computation terminates.