An oversight system is an independent guard watching an execution system. It examines each instruction the processor handles and decides whether that instruction is correct and permitted; a bad decision may signal an attack. section 14.3
CoreGuard illustrates the idea as a hybrid hardware/software design. Its hardware receives an instruction trace from the processor, decodes the instruction, finds the relevant rule, and supplies application-specific metadata before making a decision. section 14.3
The practical pieces are:
- Independent hardware: watches the companion execution system and is presented as resistant to software manipulation because it is etched in silicon. section 14.3
- Micropolicies: small, updateable security, safety, or privacy rules aimed at particular exploitable software flaws. section 14.3
- Metadata: application-specific information that lets a micropolicy interpret the software being executed. section 14.3
The hard question is not merely whether protection sounds useful. Ask how the necessary technology will be built, bought, or partnered for, how long it will take, and what it will cost before entering a market. section 14.3
