Policy vs. Mechanism in the Secure TUNIS Operating System. - G.-L. Grenier; Richard C. Holt; M. Funkenhauser (S&P, 1989)