Systems engineering

Which architectural decision most directly limits the impact of a compromised subsystem?