In Opa, you have too mechanisms that combined provide probably a very high level of security in this sense too: 1) Algebraic constructs, so that the typing system checks properties like permissions automatically 2) Client "guards", aka protected values that can't be transmitted to the client, which Opa checks automatically.