Legacy platforms/operating systems have a 1-part principal: the user. When a user logs in, they run programs that run with the full privilege of the user: all of a user’s programs can do anything the user can do on all their data and with all their resources. This has become a source of trouble since the rise of mobile code from many different origins. It has become less and less acceptable for a user’s (e.g.) word processor to (e.g.) read the user’s private SSH keys.