15.6 Further Reading
The Decentralized Label Model  allows one to specify information flow policies on a per-entity basis. Formal models sometimes lead to reports of flows not present in the system; Eckmann  discusses these reports, as well as approaches to eliminating them. Guttmann draws lessons from the failure of an information flow analysis technique .
Foley  presented a model of confinement flow suitable for nonlattice structures, and models nontransitive systems of infoormation flow. Denning  describes how to turn a partially ordered set into a lattice, and presents requirements for information flow policies.
The cascade problem is identified in the Trusted Network Interpretation . Numerous studies of this problem describe analyses and approaches [320, 441, 631]; the problem of correcting it with minimum cost is NP-complete .
Gendler-Fishman and Gudes  examine a compile-time flow control mechanism for object-oriented databases. McHugh and Good describe a flow analysis tool  for the language Gypsy. Greenwald et al. , Kocher , Sands , and Shore  discuss guards and other mechanisms for control of information flow.
A multithreaded environment adds to the complexity of constraints on information flow . Some architectural characteristics can be used to enforce these constraints .