In the access control model HRU there is the primitive request destroy object o which is only defined if o is an object in the current protection state which is not a subject. I am interested in why this restriction is necessary/useful. 
semantics of destroy object in HRU model
formal methods;security;formal systems