It seems clear to me that new concepts must be conveyed to the user that allow the user to control the nature of allowed information flows. These concepts need not have names known to the user, but the concepts themselves must be manifest to the user, perhaps graphically. We will need names for these concepts to design the system.
Two vital areas must be addressed: