Practical composability for trustworthy architectures
csl.sri.com