This pattern arose in Keykos to provide a place for code to run in response to unusual situations. Some systems provide for call back or exit routines where the user supplies a routine that is to be called upon certain unusual events. Here is how Keykos uses this pattern.

Suppose that some type of object is known to have some certain property and that it is possible to verify thru synergy that a key is to an object of that type. That object may have a keeper that modifies its behavior and state without impacting the known property. The logic of the keeper impacts some of the behavior of the kept object, but not all of it. It is thus often possible to prove some properties of a kept object by examining its code but without considering the keeper.

An order on a kept space bank to buy a new page will return the only key to a new page even if that bank’s keeper has an incentive to steal data from that page.

This pattern relies on the fact that when the kept object calls its keeper the keeper can influence the object only to the extent that the object considers the response and allows itself to be influenced. That X calls Y does not imply that X entirely trusts Y.