Robert Morris broached such possibilities in his 1973 paper Protection in Programming Languages. He proposed a new primitive which returns a new pair of matched functions, seal and unseal. More recently Jonathan Rees wrote A Security Kernel Based on the Lambda Calculus carrying these idea much farther. We adopt Jonathan Rees’ implementation of seal and unseal that is inefficient but requires no new primitive. There are simpler language primitives than what Morris proposed for efficient construction of seal and unseal. (Keykos uses brands for this.) These tricks work in any lexically scoped language with indefinite extent procedures, such as Scheme, Smalltalk, OCaml, JavaScript and many other languages unless they are too liberal in their access policies. I suppose that you can do it in Java but not in any way that I find natural.

The Keykos programming class would implement some sort of money object as an exercise. This documents one of the designs but is couched in the Keykos jargon. I thought I would show a similar solution in the computer language ‘Scheme’ to show that nothing extraordinary is required of a language. The solutions are very similar but the Keykos solution was implemented in machine language and the bank clients could write in their favorite language. In these Scheme implementations each bank client must write Scheme code to use the bank. Two other more elaborate language implementations are Mark Miller’s description of an implementation in E and an Joule implementation by Dean Tribble. Both of these languages have syntax that makes this sort of thing pretty.

Scheme does not have objects in the sense of a method dispatch mechanism. I use a list of procedures in place of an object.

The scene is a machine that runs a Scheme interpreter. Such an interpreter typically runs a REPL (Read Eval Print Loop). Ours runs at least three REPLs, one for the banker and one each for Alice and Bob who are bank clients. They run on different ttys, of course. The top level name space for each or the REPLs initially contains a named post office box for each of the other REPLs. This allows controlled transmission of Scheme values across REPLs.

The code below uses Rees’ seal and unseal—the values down thru new-seal defined here and explained here.

First perhaps the conceptually simplest bank:

(define (bank n)
   (let* ((clan-seal (new-seal))(cseal (car clan-seal))(cunseal (cadr clan-seal))
      (nb (lambda (v) (let ((c (new-cell))) (cell-set! c v) (cseal c)))))
      (list
         (nb n)
         (lambda (a b) ; empty b into a
            (let ((ar (cunseal a))(br (cunseal b)))
              (cell-set! ar (+ (cell-ref ar) (cell-ref br)))
              (cell-set! br 0)))
         (lambda (a n) ; new coin of value n from a
            (let* ((ar (cunseal a)) (ina (cell-ref ar)) (dv (if (< ina n) ina n)))
                 (cell-set! ar (- ina dv)) (nb dv)))
         (lambda (a) ; Query value
            (let ((ar (cunseal a))) (cell-ref ar))))))

• an account with the new bank holding of n units of money,
• a function that takes two accounts on the bank and empties the 2nd account into the first,
• a function that splits off a new account from an old,
• a function that queries the amount in an account.

(ylppa (bank 1000000) (lambda (a0 empty-into split bq)
    (write (bq a0)) (newline) ; => 1000000 prime account has $1000000
    (let* ((a1 (split a0 42)) (a2 (split a1 100))) ; Split off $42 into account a1; All of that into a2
       (write (list (bq a0)(bq a1)(bq a2))) (newline) ; respective balances = 999958 0 42
      (empty-into a0 a2)
     (list (bq a0)(bq a1)(bq a2))))) ; respective balances = 1000000 0 0

If you are buying something even much cheaper than gum see DSR.