G.-L. Grenier Richard C. Holt M. Funkenhauser Policy vs. Mechanism in the Secure TUNIS Operating System. 84-93 1989 IEEE Symposium on Security and Privacy db/conf/sp/sp1989.html#GrenierHF89