Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?