Privilege Separation Informational Request: Acquiring information requires privilege. Monitor returns information via IPC. Example: challenge-response authentication. Capability Request: In Unix, only capability is a file descriptor. Slave expects a file descriptor as answer. Via file descriptor passing. Example: creating a pseudo-terminal. Change of Identity Request: Changes the process credentials. Required to switch from pre- to post-authentication phase.