In contrast to traditional UNIX systems, superuser (the root user) is not used to administer Trusted Extensions. Rather, administrative roles with discrete capabilities administer the system. In this way, no single user can compromise a system's security. A role is a special user account that provides access to certain applications with the rights that are necessary for performing the specific tasks. Rights include labels, authorizations, privileges, and effective UIDs/GIDs.
The following security practices are enforced on a system that is configured with Trusted Extensions:
You are granted access to applications and authorizations on a need-to-use basis.
You can perform functions that override security policy only if you are granted special authorizations or special privileges by administrators.
System administration duties are divided among multiple roles.