"A Security Kernel Based on the Lambda-Calculus" by Jonathan A. Rees is pretty high up there: https://dspace.mit.edu/handle/1721.1/5944

I read this a few years back as I was going down an object-capability rabbit hole and found it extremely compelling. (And also made me disappointed that most of the systems we use today do not work like this! Code execution vulnerabilities would be so much less immediately hazardous if they did.)