Structured specification of a Security Kernel | Synapse