So basically, the xenstore++ is in a stripped down secured domain and someone with role-based access privileges communicates with xenstore ++ to connect a resource to a domain. Xenstore++ checks the permissions and sets up the connection where the protocol description to use is an attribute of the resource class. The protocol is policed and if it's violated then either the resource provider (BE) or consumer (FE) or both get blown away.

There can be generic mechanisms in xenstore++ for colouring resources and grouping roles etc to do fancy MAC stuff.

...or something like that.