 In such cases,
the management of access control is handled separately
from explicit communication
to the executing program or process,
through means such as access control lists associated with objects
or through Role-Based Access Control mechanisms.The executing program has no means to reify the permissions
that it was granted for a specific purpose as first-class values.So, if the program should be able to access an object when acting on
its own behalf but not when acting on behalf of one of its clients (or, on
behalf of one client but not another), it has no way to express
that intention.