tcb-identification-minimization

Use when a system must enforce a specific security policy and you must find which components have to be correct for it to hold (the trusted computing base, TCB), then shrink it: audit scope, which services need security review, language choice. Not for pentesting.