Identity Propagation and Trust Boundaries