An OS model. From its home page (see below):

MetaOS is an object-oriented system model, based on meta-levels, meta-spaces, meta-objects, and meta-interfaces, that allows applications to securely customize their run-time environment on the fly. Furthermore, it allows applications to share customizations with other applications, allows different types of security schemes to be implemented, and permits secure, remote troubleshooting of software.

In MetaOS, meta-levels allow for a coarse-grained separation between application-customizable system services and low-level-customizable system services. Meta-spaces act as firewalls that prevent their customizations from affecting neighboring meta-spaces. Meta-objects help to modularize meta-spaces into smaller, easier-to-maintain components. Finally, meta-interfaces provide the heart of the secure customization mechanism.

Meta-interfaces are strictly divided into declarative and imperative interfaces, to give meta-objects a basis on which to distinguish between local-effect and meta-space-wide-effect calls. By limiting access to meta-space-wide-effect declarative calls and imperative calls, but giving free access to local-effect calls, a basic balance between flexibility and secure customization can be struck. Flexibility then is furthermore enhanced by allowing imperative changes to be exported as local-effect declarative options, by permitting untrusted applications to negotiate changes with trusted meta-space managers, and by allowing untrusted applications to migrate to cloned meta-spaces and alter them as necessary.