Implicit discretionary access propagation: a new interpretation of DAC

In most trusted systems, discretionary access to objects can be obtained in ways not explicitly allowed by the discretionary access control (DAC) policy. This well-understood observation is examined in the context of client-server architectures, and compared both to the traditional understanding of DAC and to existing trusted systems. The results are used as the basis for an argument for a new understanding of DAC and its implications for the design of trusted systems