Security policies define who may use what information in a computer system. Protection mechanisms are built into a system to enforce security policies. In most systems, however, it is quite unclear what policies a mechanism can or does enforce.
No takes yet. Share an insight, caveat, or question.
Jones et al. (1975) studied this question.