. "Conversely, if there is a requirement that SA should not be able to reach DA, but we find that there is a path, then we present this violation to the user." . . .