A set of architectural extensions to a machine of the type of IBM System/370 is proposed. The proposal involves hardware/software interaction to constrain the execution-time behavior of application and higher authority programs. The extensions consist of new states of privilege, enforcement of disciplined transition between states, hardware distinction of information types, and a mechanism to control data transfers between main and external storage. Application of the extensions to a shared database system, where users interact through a high-level language, shows that protection of the operating system and the database can be enhanced significantly with respect to errors or deliberate attacks from users

An authorization model is presented, applicable to a shared data base with well defined data structures. Access to this data base is made through a high level language, which is extended to permit data manipulation and to provide data views for different applications. The authorization model includes: 1) the explicit introduction of the concept of application into the definition of user rights; and 2) the use of predicates that can depend on any data in the system to control access at the data field level. Enforcement of authorization is distributed along time (mostly at compile time), and uses the view mechanism to make evident the application program data requests, which are checked by a centralized procedure that consults the access matrix. The system is shown to provide comprehensive authorization, including implementation of levels and compartments, special access restrictions, content-dependent, context-dependent and functional access.