As there is no file system, all the secondary memory in the system is nothing but paging store. If a process references a non-resident object, the kernel will obtain a copy and store it in local primary memory. This is not different from paging in traditional VM systems, except that a page may be obtained from disk or across the network. An object is the unit of protection. No other structure on objects is assumed by the system, but higher software layers are free to impose structure.
Protection is based upon password capabilities, address-password pairs.
Any holder of a valid capability to an object can access that object. Capabilities can be passed around freely, they are not system objects, but protected by sparsity. This allows execution of programs that have no knowledge of the operation of the protection system. This is the basic philosophy. These are, however, user-level services, the system doesn't care about them.