Trusted system 2: rule

{    :request acc:forDocument :d;
             acc:requestSupportedBy :k.

    []       acc:certSupportedBy :k2;    # Certificate
             log:includes { :k a acc:RequestKey }.

    []       acc:certSupportedBy [a acc:MasterKey];    # Certificate
             log:includes { :k2 a acc:MemberKey }.
}
 => { :request a acc:GoodRequest }.

Transparent security - can be analysed and checked against policy.