Protection In Programming Languages

"Protection in Programming Languages" (at http://www.erights.org/history/morris73.pdf ) explains how the GedankenLanguage -- an untyped descendent of Algol60 (AlgolLanguage) with true SchemeLanguage-like indefinite extent LexicalClosures -- implements the DennisAndVanHorn security model, now known as the ObjectCapabilityModel.

This paper is the first statement of the ObjectCapabilityModel in a ProgrammingLanguage context, and remains one of the best. It's particularly strong on RightsAmplification mechanisms.