diff --git a/SPEC.md b/SPEC.md
index c30dbca1..739cbebc 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -190,7 +190,7 @@ Note that logging mechanisms other than stdout and stderr are not required by th
 
 #### Execution Environment
 
-* **Working directory** defaults to the root of the application image, overridden with "workingDirectory"
+The following environment variables MUST be set for each application's main process and any lifecycle processes:
 * **PATH** `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`
 * **USER, LOGNAME** username of the user executing this app
 * **HOME** home directory of the user
@@ -198,6 +198,10 @@ Note that logging mechanisms other than stdout and stderr are not required by th
 * **AC_APP_NAME** name of the application, as defined in the image manifest
 * **AC_METADATA_URL** URL where the metadata service for this container can be found
 
+An executor MAY set additional environment variables for the application processes.
+
+Additionally, processes must have their **working directory** set to the value of the application's **workingDirectory** option, if specified, or the root of the application image by default.
+
 ### Isolators
 
 Isolators enforce resource constraints rather than namespacing.
diff --git a/ace/validator.go b/ace/validator.go
index 7ef5eb7c..6bab286d 100644
--- a/ace/validator.go
+++ b/ace/validator.go
@@ -177,8 +177,8 @@ func ValidateWorkingDirectory(wwd string) (r results) {
 	return
 }
 
-// ValidateEnvironment ensures that the given environment exactly maps the
-// environment in which this process is running
+// ValidateEnvironment ensures that the given environment contains the
+// necessary/expected environment variables.
 func ValidateEnvironment(wenv map[string]string) (r results) {
 	for wkey, wval := range wenv {
 		gval := os.Getenv(wkey)
@@ -187,16 +187,6 @@ func ValidateEnvironment(wenv map[string]string) (r results) {
 			r = append(r, err)
 		}
 	}
-	for _, s := range os.Environ() {
-		parts := strings.SplitN(s, "=", 2)
-		k := parts[0]
-		_, ok := wenv[k]
-		switch {
-		case k == appNameEnv, k == "PATH", k == "TERM", k == "AC_METADATA_URL":
-		case !ok:
-			r = append(r, fmt.Errorf("unexpected environment variable %q set", k))
-		}
-	}
 	return
 }