Practical considerations for annotation-based security