Graham-Denning

In other words, Graham-Denning is primarily concerned with how a model system controls subjects and objects at a very basic level where other models simply assumed such control.

Now, there is a lot here, so follow along.

The Graham-Denning access control model has three parts: a set of objects, a set of subjects, and a set of rights. The subjects are composed of two things: a process and a Domain. The Domain is the set of constraints controlling how subjects may access objects. Subjects may also be objects at specific times. The set of rights govern how subjects may manipulate the passive objects. As we will see... This model describes eight primitive protection rights called commands that subjects can execute to influence other subjects or objects.

Note that Graham and Denning use the term primitive protection rights much in the same way that other security models describe permissions or privileges.

As an example, the deletion of an object is an action that is performed by a subject (usually by means of a task, process, or other software entity). The access control system in use should not allow this to take place unless that subject has the right, or permission, or privilege to do so.

Whether that right, permission, or privilege is granted to that subject for all objects, for a subset of all objects, or only on a per-object basis is dictated by the chosen access control model.