Security and Privacy by Declarative Design