A system to enforce file system path-based access control in a message-based operating system, the system comprising: a processor; and a path manager executable by the processor to enforce a list of rules that provide an access restriction to file system paths to server applications (118, 120); the server applications configured to receive client messages via a communication channel in the message-based operating system, commands to operating system elements being transmitted as client messages over the communication channel; wherein the path manager is further executable by the processor to receive, via the communication channel, client messages corresponding to a request from a client (112, 114, 116) to open a file system path and flagged by a kernel of the message-based operating system to indicate that the client messages are subject to the path-based access control; wherein the path manager is further executable by the processor to access the rules governing access to the file system paths; wherein the path manager is further executable by the processor to control access to file systems served by the server applications in response to the rules that provide the access restriction to file system paths; and wherein the path manager is further executable by the processor to transmit, via the communication channel, reply messages to a sender of the client messages, the reply messages including a digital signature by the path manager and a list of server applications that can service the request, to establish limited access to the file system paths through an authentication protocol, the digital signature assuring the identity of the path manager and the integrity of the reply messages at the sender of the client messages; wherein the client (112, 114, 116) transmits the reply messages to each server application of the list of server applications for enforcement of the access restriction to file system paths. a processor; and a path manager executable by the processor to enforce a list of rules that provide an access restriction to file system paths to server applications (118, 120); the server applications configured to receive client messages via a communication channel in the message-based operating system, commands to operating system elements being transmitted as client messages over the communication channel; wherein the path manager is further executable by the processor to receive, via the communication channel, client messages corresponding to a request from a client (112, 114, 116) to open a file system path and flagged by a kernel of the message-based operating system to indicate that the client messages are subject to the path-based access control; wherein the path manager is further executable by the processor to access the rules governing access to the file system paths; wherein the path manager is further executable by the processor to control access to file systems served by the server applications in response to the rules that provide the access restriction to file system paths; and wherein the path manager is further executable by the processor to transmit, via the communication channel, reply messages to a sender of the client messages, the reply messages including a digital signature by the path manager and a list of server applications that can service the request, to establish limited access to the file system paths through an authentication protocol, the digital signature assuring the identity of the path manager and the integrity of the reply messages at the sender of the client messages;