A protection domain specifies the resources that a process may access.
Each domain defines a set of objects and the types of operations that may be invoked on each object.
An access right is the ability to execute an operation on an object.
A domain is defined as a set of < object, { access right set } > pairs, as shown below. Note that some domains may be disjoint while others overlap.