Protection and the Control of Information Sharing in Multics