During the development of security-critical software, the system implementation must capture the security properties postulated by the architectural design. This paper presents an approach to support ...