Abstract: Each file in a computer system has associated with it a token. No user is permitted to update any file unless that user is the current token holder. Thus, in multi-sited computer installations where nominally identical files are held in several data stores, only one copy of the file is ever updated at any one time. Tokens can only be transferred from one user to another with the permission of the current token holder, and on transfer of a token the latest version of the file accompanies that token. Some nodes of a computer system may have read access to obsolete versions of a file but each node holding an obsolete file is notified of current file versions available.