• Complexity. Implementing API call delegation correctly is difficult, especially the stateful calls. For example, when a call takes a parameter that refers to a context local to the application (e.g. database connection or file handle), the delegation must map the corresponding contexts between the untrusted and reference monitor applications, which is difficult and error prone.