Tyler Close wrote: >It follows that everyone also agrees that the capability model is >theoretically sound. Can you give me a definition of what it means for a protection mechanism to be theoretical sound, or point me to a paper where such a definition is proposed?