Design principles · 1975
The Protection of Information in Computer Systems
Saltzer JH, Schroeder MD
What it found
The classic list of design principles for protecting information, including 'fail-safe defaults': when something goes wrong, a system should fall to the safe side, and access should be denied unless explicitly allowed.
Where the evidence stops
About computer security, not behaviour. We use it as an engineering principle, by analogy.
How it shapes Pursue
Pursue
When Pursue cannot work reliably, it says so rather than producing something that looks like advice.
A design input, not evidence that Pursue works.