Security measures designed to make the user do the right thing on their computer. These cannot be trusted completely, which is why software developers need to also rely on server-side security controls.