This is a scheme that complements the user compartment idea above {(user-compart)}. The basic idea is that communication with other users in other compartments is via the guard that makes an indelible record of such communications.

The guard's record supports conclusions about information flow. The transmission may include a key but only under one of these provisos:

The sender determins the recipient by EBCDIC name in a name space known to the guard.