data derived from Event B as Event C, the same security restrictions are stillenforced.Figure 2 also shows an anonymiser module, which has additional trust in theform of declassification privileges. It uses these to publish an anonymised eventcount. Other portions of the infrastructure, such as the RBAC module, operateentirely within the IFC framework—all of their communications and data aresubject to its restrictions. In contrast, the boundary access controls in figure 1are insufficient to prevent the event counting component (Σ) from potentiallyaccumulating identified data.