This would be the case if only one user at a time were permitted to gain access to an object. However, in the multiple user environment, a given object could be in use by a large number of users, perhaps with different access privileges. In general, this case is handled within the same framework as for the single user; since each user's process is represented by a descriptor table (segment) unique to that user, the descriptor referring to such an object can have the access control information set to the appropriate value for that user. The actual checking on access type is accomplished on modern systems in hardware as a descriptor is referenced. Within this general framework, a number of secondary problems emerge. Graham\cite{3} treats protection as a disjoint series of rings, and discusses the problems of changing control from one protection level (viewed as concentric circles or rings) to another in a safe manner. To provide protection in both a downward (from a superior routine to an inferior routine) as well as an upward direction, he proposes a model that augments the descriptor for a segment with ring bounds that permits free access as long as the element being transferred to is within the bounds but invokes special software whenever the bounds are exceeded in either direction. In general, the special software validates the address being referred to regardless of the direction of the reference. In this way, the mechanism protects a process from the operating system as much as the other way around.

Vanderbilt\cite{4} has created a model that extends that of Graham to include cases that arise when a user sharing an object authorizes others to use the process he creates. In his model, he introduces the notion of access privileges as a function of the activation level of the process, and in effect makes copies of the descriptor segment for each activation level encountered in order to provide the precise control needed. He distinguishes the problems that arise from direct access to a shared procedure, and adopts as part of the model the policy that direct sharing of procedures is only permitted for procedures authorized to the borrower by their owner, while only indirect sharing of procedures is permitted for those procedures owned by a third party and authorized and used by an owner in constructing a procedure that is (to be) shared with others. In the latter case, a borrower can only affect indirect access to procedures borrowed by the owner of a shared procedure.

\section{Models for Hierarchical Access Control}

The only available work that deals with this subject in a formal manner is that of Weissman\cite{5}. In it the author defines security objects (files, users, terminals, and jobs) and security properties associated with the objects. The properties are Authority (a hierarchical set of security jurisdictions --- classification), Categories (a mutually exclusive set of security jurisdictions --- a formalism of the need-to-know policy), and Franchise (clearance).

The balance of the paper is devoted to developing a set-theoretic statement of the policy adopted in the ADEPT-50 system:

 a) A user is granted access to the system only if he is a member of the set of users known to the system.