This paper describes a protection system that supports the confinement of access as required by non-discretionary access control models such as the Bell and LaPadula lattice model. The approach is to use capability-based protection at the lowest level for implementing confined domains, in support of access control lists for expressing security policies outside the security kernel. The implementation of such a system in the context of hardware support for capabilities is discussed.

It is sometimes necessary in the course of a distributed computation to arrange that a certain set of operations is carried out in the correct order and the correct number of times (typically once). If several sets of operations are performed on different machines on the network there is no obvious mechanism for enforcing such ordering constraints in a fully distributed way. This lack basically stems from the difficulty of preventing copying and repetition of messages by machines and from the impossibility of constraining externally the actions of machines in response to messages that come into their hands.