Take-grant protection model