Fwiw, this is the now-dropped claim, which is claim #14 from a patent with the ultra-generic title, "Controlling access to a resource":
A computer-readable medium bearing instructions for providing security, the instructions including instructions for performing the steps of: detecting when a request for an action is made by a principal; determining whether said action is authorized based on an association between permissions and a plurality of routines in a calling hierarchy associated with said principal; wherein each routine of said plurality of routines is associated with a class; and wherein said association between permissions and said plurality of routines is based on a second association between classes and protection domains.
In other words, each user is associated with a class, which contains routines, and each class is associated with a protection domain.
A computer-readable medium bearing instructions for providing security, the instructions including instructions for performing the steps of: detecting when a request for an action is made by a principal; determining whether said action is authorized based on an association between permissions and a plurality of routines in a calling hierarchy associated with said principal; wherein each routine of said plurality of routines is associated with a class; and wherein said association between permissions and said plurality of routines is based on a second association between classes and protection domains.
In other words, each user is associated with a class, which contains routines, and each class is associated with a protection domain.