Our first project was to enhance Scheme to support an environment within a machine where proprietary software from several sources could provide metered service, or serve on other conditional terms. We planned to adapt factory design to Scheme to provide for confinement. This required bringing the sensory mechanisms of the Keykos kernel to Scheme. Inspired by the Rees paper, I have recorded some ideas for sensory function in Scheme but conforming to Scheme’s style of ontology which does not include references. Here is a tentative transcription of the Keykos factory into Scheme.
Synopsis of multiuser Scheme; Sneaking up on Multiple user Scheme.
This paper outlines several good mutual-suspicion scenarios and a proposal to solve them.

Here is a toy illustrative exercise in Scheme, and another.

Perhaps Vapour, is a language along the above lines.