When one software flaw can become an attack, a single giant security rule is hard to trust or change. A micropolicy is a small, focused security, safety, or privacy rule that defines the oversight needed for a particular flaw or attack type. section 14.3
In CoreGuard, hardware examines each processor instruction, finds the relevant micropolicy, supplies application-specific metadata, and decides in real time whether to allow the instruction or stop the processor. Micropolicies are fungible, so they can be updated as threats or requirements change. section 14.3
Three micropolicies are always present:
- Heap micropolicy: addresses buffer-overflow attacks. section 14.3
- Stack micropolicy: addresses stack smashing and return-oriented programming attacks. section 14.3
- Read–write–execute micropolicy: prevents unauthorized writes to memory. section 14.3
The practical lesson: keep each rule narrow and tied to one failure mode. That makes oversight specific enough to act on while leaving room to update the rule set over time. section 14.3
