{"_self":{"principle":"Self-explaining payload — no external context required. This _self block describes what you are reading and where to look next.","widget":"article_topology","feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","contains":"claims, sources, anecdotes, question_graph slice","slug":"thinker-norman-hardy","urls":{"read":"https://miscsubjects.com/api/articles/thinker-norman-hardy/topology"},"how_to_use":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","write":null,"imessage":null,"router_tag":null,"proof_chain":[{"step":1,"claim":"Articles are voxel graphs of tiered claims, not prose blobs.","verify":"https://miscsubjects.com/api/articles/constitution"},{"step":2,"claim":"Claims link to hash-chained sources via source_ids.","verify":"https://miscsubjects.com/api/articles/thinker-norman-hardy/sources"},{"step":3,"claim":"Ask reads topology; ingest/claim append to ledger.","verify":"https://miscsubjects.com/api/protocol"},{"step":4,"claim":"Models queue growth: populate → collaborate → repair → reflex.","verify":"https://miscsubjects.com/api/protocol/grow"},{"step":5,"claim":"Graph proves its own shape (reflex) and $/claim (yield).","verify":"https://miscsubjects.com/graph.html?layer=reflex"},{"step":6,"claim":"Full feature index + _explain on every API response.","verify":"https://miscsubjects.com/api/articles/system-map"}],"related_features":[{"id":"ask","name":"Ask protocol","what":"Answer only from topology; creates question_node with gaps and ingest_hint.","urls":{"read":"https://miscsubjects.com/api/articles/thinker-norman-hardy/prompts","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"graph_topology","name":"Cross-article graph","what":"Merged claims/sources across condition+stack slugs for one question.","urls":{"read":"https://miscsubjects.com/api/articles/thinker-norman-hardy/graph-topology?question=..."}},{"id":"question_graph","name":"Question graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output).","urls":{"read":"https://miscsubjects.com/api/articles/thinker-norman-hardy/question-graph","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"voxels","name":"Voxel graph","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance.","urls":{"read":"https://miscsubjects.com/api/articles/thinker-norman-hardy/voxels","write":"https://miscsubjects.com/api/protocol/claim"}}],"system_map":"https://miscsubjects.com/api/articles/system-map","system_map_markdown":"https://miscsubjects.com/api/articles/system-map?format=markdown","not_medical_advice":true},"_explain":{"feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","why":"Every feature is auditable collective intelligence","how":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","model":null,"verifies":null,"urls":{"read":"https://miscsubjects.com/api/articles/thinker-norman-hardy/topology"},"imessage":null,"router":null,"related":[{"id":"ask","what":"Answer only from topology; creates question_node with gaps and ingest_hint."},{"id":"graph_topology","what":"Merged claims/sources across condition+stack slugs for one question."},{"id":"question_graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output)."},{"id":"voxels","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance."}],"not_medical_advice":true},"slug":"thinker-norman-hardy","title":"Norman Hardy — KeyKOS and the Persistent Capability Operating System","register":"standard","tags":["oip","kimi-import","self-explaining","voxel","thinkers","thinker-norman-hardy"],"updated_at":"2026-07-15T04:20:42.979Z","body_excerpt":"<!-- hierarchy:nav -->\n> **Path:** [OIP](https://miscsubjects.com/a/oip) › [Thinker Reference](https://miscsubjects.com/a/oip-thinker-reference) › [Thinkers](https://miscsubjects.com/a/oip-thinkers) › **Norman Hardy — KeyKOS and the Persistent Capability Operating System**\n>\n> **Shelf:** Thinkers · **Traversal:** self-explaining · hierarchical · voxel-ready\n> **Machine root:** [OIP tree](https://miscsubjects.com/api/dispatch?map=1&format=markdown) · [Registry](https://miscsubjects.com/api/dispatch?registry=1)\n\n# Norman Hardy — KeyKOS and the Persistent Capability Operating System\n\n## §SELF — thinker-norman-hardy\n\n**What this page is:** A profile of the computer scientist who built the first commercially deployed capability-based operating system.\n**What it explains:** Norman Hardy's KeyKOS system and its core innovations in persistent object-capability architecture.\n**Why read it:** To understand how capability-based security works in practice and why it matters for modern system design.\n\n### What Norman Hardy Did\n\nNorman Hardy (born 1933) is a computer scientist who led the development of KeyKOS at Key Logic in the 1980s. KeyKOS was the first capability-based operating system deployed commercially.\n\nA capability (in operating systems) is an unforgeable reference that carries authority. It is a token proving that the holder has permission to access a specific object (a file, a process, a device, or any system resource). Capabilities are first-class objects: they can be passed between processes, stored in files, and sent across networks.\n\n### Why It Matters\n\nBefore KeyKOS, operating systems used access control lists (ACLs) — lists attached to resources specifying which users could access them. ACLs have a problem: they grant authority based on identity, not on need. A process running with root or administrator privileges can access everything, even when it only needs one file. This is the confused deputy problem: a program (the deputy) acts on behalf of a user and uses its own authority instead of authority delegated for a specific task. KeyKOS solved this by making capabilities the only access mechanism.\n\n### The Key Idea\n\nKeyKOS is a persistent object-capability operating system. Every object in the system is accessed through a capability. There are four defining properties:\n\n1. **Every object is persistent.** The system's state is checkpointed to disk at regular intervals. You can turn off the machine and turn it back on, and everything resumes exactly where it was. Processes, files, and open connections are preserved.\n\n2. **Capabilities are the only access mechanism.** There are no passwords, no access control lists, and no root account. If you do not hold a capability for an object, you cannot access it. The capability itself is the proof of permission.\n\n3. **The confused deputy problem is impossible.** Authority is in the capability, not in the process. A process can only use the capabilities it holds. It cannot escalate its own authority.\n\n4. **Factory pattern.** Objects are created by factory objects — pre-configured templates that produce new objects with a specific set of capabilities. A factory object creates a new object and hands back a capability to it. The creator controls what the new object can do by deciding which capabilities the factory includes.\n\n### What He Got Right\n\n- Proved that a capability-based operating system can be practical and commercially viable.\n- Demonstrated that persistence at the OS level is achievable: checkpointing the entire system state to disk eliminates the distinction between memory and storage.\n- Showed that removing the root account and ACLs does not make administration harder — it makes security violations harder.\n- Invented the factory pattern for capability creation, which is still used in capability-secure systems today.\n\n### What He Got Wrong or Left Unfinished\n\n- KeyKOS required specialized hardware (the IBM System/38), limiting adoption.\n- Network-transparent capabilities w","ranking":"safety-first (interaction_risk/limitations), then quote-gated effective_weight","claims":[],"sources":[],"anecdotal_sources":[],"scientific_sources":[],"user_reports":[],"related_articles":[],"question_graph":{"slug":"thinker-norman-hardy","questions":[],"evidence":[],"edges":[],"counts":{"questions":0,"evidence":0,"edges":0}},"honesty":{"active_claims":0,"retracted_claims":0,"cut_claims":0,"challenges":0,"scrub_events":0,"note":"Retracted/cut claims stay on ledger but are excluded from ask unless ?include_inactive=1"},"counts":{"claims":0,"claims_total":0,"sources":0,"anecdotal":0,"scientific":0,"user_reports":0,"questions":0,"evidence_ingests":0}}