Every systematic approach I've seen to enforcing privacy, nondisclosure, etc. and has to deal with dynamic security rules ends up having to include knowledge of information flow (via things like program counters, aka lifetimes, and in some cases explicit ownership tracking) into the language. Rust isn't enough but I think something like it will be necessary to take that next step.