\begin{description}
\item[Type Layer] This layer describes bare skeletons of
  interaction scenarios, including what message types are used
  and how the conversation is structured. It assures:
  \begin{description}
  \item[(T1)] {\em Communication safety} which includes {\em
      type safety} and {\em linearity}: if you send, the other
    peer is waiting for a message of that type, and vice
    versa: there is a one-to-one correspondence between
    sending and receiving.
  \item[(T2)] {\em Session Fidelity}: interaction sequences
    precisely follow the scenario given in the protocol.
  \end{description}
\item[Assertion Layer] This layer allows consistent assertions
  on values and branches by elaborating descriptions in the
  type layer.  It assures, in addition to the above (T1) and
  (T2):
  \begin{description}
  \item[(A1)] {\em Assertion safety}: If a validated program
    sends a value, it is in the expected range of the values
    of the other peer.
  \item[(A2)] {\em Session Fidelity}: interaction sequences
    follow the scenario given in the protocol, including how
    message values exchanged will affect later message values
    as well as possible courses of the conversation.
  \end{description}
\item[Protocol Document Layer] This layer allows assertions over
  multiple protocols.  It assures, in addition to all of the above:
  \begin{description}
  \item[(P1)] {\em Policy safety}: the whole behaviour of an agent or
    a set of agents follow the policy (global constraints) specified
    in the protocol document, possibly referring to values obtained
    from distributed sites at runtime.
  \end{description}
\end{description}
 (in
particular, A1, A2 and P1 may naturally demand monitoring).
Throughout the three layers, the assurance for a statically
validated program follows the reciprocity principle:
\begin{quote}
  {\em A validated endpoint program behaves well if the environment
    behaves well.}
\end{quote}
Note that a monitor filters incoming messages based on protocols hence
{\em forcibly} ``makes'' the environment behave well: thus a
statically validated program under a communication monitor always
behaves safely.