Persistent systems support a single storage abstraction in which all data may be created and manipulated in a uniform manner, regardless of its longevity. In such systems a protection mechanism is required to ensure that programs can access precisely those objects they are supposed to access and no others. In a monolingual system this protection can be provided by the type system of the program...