Protection and the Control of Information Sharing in Multics
The design of mechanisms to control the sharing
of information in the Multics system is described. 
 Five design principles help provide insight into the
tradeoffs among different possible designs.  The 
key mechanisms described include access control lists,
hierarchical control of access specifications, 
identification and authentication of users, and primary
memory protection.  The paper ends with a discussion 
of several known weaknesses in the current protection mechanism design.
CACM July, 1974
Saltzer, J. H.
