A Secure Capability Computer System
Simon R. Wiseman · 1986
A secure computer system based on a capability architecture is described. Abstract types are used to provide separation and the reference monitor function. By providing a trusted path from the user to security critical operations, full discretionary and mandatory access controls are enforced.