Enforcing unidirectional data flow