What are the essential characteristics of the reference monitor