 This not only means that executing programs
are inevitably given more permissions
than they need for their task,
but that they are unable to determine
the source or the number and types of permission that they have.A program executing under an ambient authority access control model
has little option but to designate permissions
and try to exercise them, hoping for the best.This property requires an excess of permissions
to be granted to users or roles,
in order for programs to execute without error.