Right, but where do you get the proof to begin with? Using your OS example, it seems like the OS would need to precompute all of the possible accesses for the file picker? In this case, the OS is an authorization system.
Do you mean that the directory should not be responsible for making this decision and there should be a central authorization authority?
Do you mean that the directory should not be responsible for making this decision and there should be a central authorization authority?