The "Provably Secure Operating System" See PSOS Revisited at http://www.csl.sri.com/neumann/psos03.pdf
This has nothing, as far as I can tell, to do with the the RealTime OperatingSystem pSOS, currently sold by WindRiverSystems (which they bought, picked out some technology, and discarded in favor of WRS's own product VxWorks)
ObjectCapabilityOperatingSystem, CategoryOperatingSystem