 access control 
to encryption and activity monitoring, these interfaces must be designed to 
protect against both accidental and malicious attempts to circumvent policy. 
Furthermore, organizations and third parties often build upon these interfaces 
to offer value-added services to their customers.  This introduces the 
complexity of the new layered API; it also increases risk, as organizations may 
be required to relinquish their credentials to third-parties in order to enable 
their agency. 
4.1 Implica