Types for Lexically-Scoped Access Control

We develop a new system for defining and enforcing access control statically. In our system, key-pairsguard access to resources, and the association between key-pairs and resources can be changed at anyprogram point (i.e., the binding is late). Our static system uses an ordering on lexically scoped abstractnames to allow local access control policies to be enforced in other parts of a program. In particular,this means that individual program components can locally refine access control policies and the policieswill be respected by the entire program. The result is a system that can enforce, at compile time, a widevariety of useful, fine-grain access control patterns.