A Theory of Information-Flow Labels