Notes:
- reference monitor, mandatory access control, type enforcement what are those?
- subject is user or process, object is the resource the subject is trying to use
