Security boundaries versus trust boundaries