Sometimes it is desired to send data out of a discreet object but to limit the quantity of information.

As a case in point assume an abstract object implemented with proprietary code. Assume that the author wants to arrange for the sending of a measure of use of his code suitable for producing a bill.

We assume trusted code that runs in a domain called SLOW. SLOW obeys the rules below and that the author and user both believe it:

SLOW holds a start key to a billing domain with which the author communicates. The domain that obeys the trusted code holds a key to SLOW. As the proprietary code is executed it causes SLOW to be called, passing a number indicating some amount of service that is to be billed for.

On the first of every month SLOW uses its start key to pass the truncated sum of these amounts to the author's billing domain. The truncation is to prevent the passing of low order bits of the sum which do not contribute significantly to the billing process. The remainder from the truncation is retained for next month.

See (p2,col) for a proposed object type.