That's not a model. What's the model that prevents this? User performs a 2-step auth every time code executes?

Just pick one that gives the feature I described without being a pain to the user.

I know of no such models. Perhaps someone smarter than me has thought of them, that's why I asked the question initially.

Sandboxing, where each process is only allowed to use a precise set of system resources.

Any attempt to use anything else leads to termination.

Which resources are they allowed to use? What defines which resources they are given?

> Which resources are they allowed to use?

The system administrator at installation time.

> What defines which resources they are given?

Applications just have a request list of what they require.

If the administrator doesn't allow them for the given application modules (executable, dynamic library, function call,...), bad luck.

Sandboxing. It's present on OS X.

I'm confused. The original person I responded to said that no desktop OSes had good security models. On OSX I can write a script that, when run as a user, has access to everything the user has access to. So what exactly are you talking about?

I'm talking about OS X sandboxing. The hypothetical PDF reader doesn't have access to the email.