The AppControl project enhances Digital Security By Design (DSbD) for mission-critical Systems-on-Chip. It uses the capabilities provided by the CHERI architecture to enable Design-by-Specification: the Systems-on-Chip has a formal, executable specification (typically created by the system architect), and every software component of the SoC is forced to adhere to this specification. Programs with incompatible specifications cannot run; unspecified run-time behaviour will raise an exception. The practical realisation is through the extension of programming languages to supports expressive specifications and a toolchain which ensures that the specifications are enforced at run time on Capability hardware. Our project was funded by the Digital Security by Design (DSbD) Programme delivered by UKRI to support the DSbD ecosystem... With the current state of the art, it is possible to limit the access privileges of a third-party program running on a computer system. The addition of..