Must ensure one process has no more privileges than it needs.

Which of the following is NOT a requirement for a security kernel? - Must facilitate isolation of processes - Must be invoked at every access attempt - Must ensure one process has no more privileges than it needs - Must be small enough to be tested and verified in a comprehensive manner