1. Boebert, W.E.: On the inability of an unmodified capability machine to enforce the *-property. In: Proceedings of 7th DoD/NBS Computer Security Conference, September 1984, pp. 45–54 (1984), http://zesty.ca/capmyths/boebert.html
2. Bishop, M., Snyder, L.: The transfer of information and authority in a protection system. In: Proceedings of the seventh ACM symposium on Operating systems principles, pp. 45–54. ACM Press, New York (1979)
3. Dennis, J.B., Van Horn, E.C.: Programming semantics for multiprogrammed computations. Technical Report MIT/LCS/TR-23, M.I.T. Laboratory for Computer Science (1965)
4. Frank, J., Bishop, M.: Extending the take-grant protection system (December 1996), Available at: http://citeseer.ist.psu.edu/frank96extending.html
5. Hardy, N.: The confused deputy. ACM SIGOPS Oper. Syst. Rev 22(4), 36–38 (1989), http://www.cap-lore.com/CapTheory/ConfusedDeputy.html