Privilege Separation

Two phases of a privilege separated service:
Pre-Authentication Phase:
Unauthenticated user.
Unprivileged slave has no process privileges and no file system access rights.

Post-Authentication Phase:
Authenticated user.
Unprivileged slave has the privileges of the user including file system access, etc.

Different types of requests depending on their result:
Information.
Capabilities.
Change of Identity.