Separation of mechanism and policy
= Separation of mechanism and policy
Distinguishing the operations a system can enforce from the choices about how to use them. In a <microkernel>, a protected <IPC> operation can deliver requests while a <user-space service> decides which <files> a caller may read. The division is a design choice: every real mechanism still has rules and limits.