Commercial service systems should allow customers to control their service configurations. The challenge is to make this feature feasible in such a way that the system is easy to administer while ensuring the security of both customer's service and the control system itself. Simple security mechanisms, such as access control lists used in general-purpose computer systems, are insufficient for administration control and authority delegation in commercial service systems. The author proposes a security policy called an 'authorization policy' suitable for administration and authorization controls. This security policy is enforced through a unified protection mechanism called an 'access control hierarchy'. The application of this access control hierarchy is demonstrated by examples.>

A specification and verification method is presented for preventing denial of service in absence of failures and of integrity violations. The notion of user agreements is introduced, and it is argued that lack of specifications for these agreements and for simultaneity conditions makes it impossible to demonstrate denial-of-service prevention, in spite of demonstrably fair service access. The use of this method is illustrated with an example and it is explained why current methods for specification and verification of safety and liveness properties of concurrent programs do not handle this problem. The proposed specification and verification method is meant to augment current methods for secure system design.>