The Structure of a well-protected computer. - R. D. H. Walker (1973)

The Cambridge CAP Computer and its Protection System. - Roger M. Needham; R. D. H. Walker (SOSP, 1977)