User interface for a high assurance, windowing system

High assurance graphical user interfaces must walk a fine line between providing user-friendly features and providing so much functionality that the trusted portion of the user interface can no longer be considered "minimal". This paper describes the user interface provided by TRW's Trusted X prototype and some of the tradeoffs made in its construction.<
>