refer now to fig1 which illustrates a typical hardware configuration of a workstation with a central processing unit 10 , such as a conventional microprocessor , and a number of other units interconnected via a system bus 12 . the workstation shown in fig1 includes a random access memory ( ram ) 14 , read only memory ( rom ) 16 , an i / o adapter 18 for connecting peripheral devices such as disk units 20 to the bus , a user interface adapter 22 for connecting a keyboard 24 , a mouse 26 , a loudspeaker 28 , a microphone 32 , and / or other user interface devices such as a touch screen device ( not shown ) to the bus , a communications adapter 34 for connecting the workstation to a data processing network and a display adapter 36 for connecting the bus to a display device 38 . although fig1 shows a typical ` intelligent ` workstation , a workstation may in fact be a dumb terminal with only a limited processing capability , under the control of a host processor . this will be made clear in connection with fig2 . fig2 illustrates a data processing system comprising a number of workstations ( here , three workstations w1 , w2 and w3 ) interconnected via a data network so as to permit communication between the workstations . it is assumed that the data processing system shown in fig2 is of a type which will permit concurrent real time communication between the users . in fig2 the workstations are connected as part of a local area network under the control of a file server ( fs ). the network operates according to a conventional network protocol , such as the token ring protocol . fig2 shows just one possible hardware configuration for a data processing network . other configurations are possible . for example , the data processing system could be based upon a star network , or based upon a host processor connected to a plurality of dumb terminals , or based upon a plurality of remote processors connected by a communications network . the network could also be based upon the telephone network , an isdn network or any other ` dial up ` network . the workstations could be located within a single workspace , or within a local area ( eg in a building ), or could be remote from one another . referring now to fig3 three workspaces or rooms 50 , 52 , 54 are shown in schematic form . the three rooms are labelled ` fred ` 50 , ` jim ` 52 , and ` meeting room ` 54 . rooms 50 and 52 are associated with individual users , but are public in the sense that other users can access those rooms with permission from the respective owners . room 54 is a shared workspace which can be entered by a number of users at a single time in order to discuss and operate on shared data . in the context of the present description , visual communication between a user and a workspace concerns the ability of that user to see on his display screen objects displayed in that workspace . in addition , full visual communication allows the user to manipulate those objects using tools and utilities in the workspace itself . a typical application might be that of a first user having full visual access to a second user &# 39 ; s workspace . in this case , the two users would both be able to see , manipulate , and operate upon screen objects displayed in the workspace . this principle , ` what you see is what i see `, or ` wysiwis `, has been described in an article by stefik et al , entitled ` beyond the chalkboard : computer support for collaboration and problem solving in meetings `, communications of the acm 30 , pages 32 to 47 . access to each workspace is under control of a respective ` agent ` computer program 56 , 58 , 60 . alternatively , a single agent may control more than one workspace i . e . he may control his own personal workspace and a public meeting room . the agent maintains lists of which users are allowed access and what those users are privileged to do in the workspace . when a request for access to a workspace is made , the agent controls the grant of that access and supervises communication between the user and the workspace . the agent may also pass or forward the request to another workspace agent which can deal with it more effectively . this may be used when an owner is away from his current workspace , but needs to be contacted immediately . in this situation the agent could transfer a request onto the agent dealing with a meeting room or if the owner is currently a visitor in another person &# 39 ; s workspace , then the agent could pass the request onto that person &# 39 ; s workspace agent . instead of providing access to a selected workspace , a door could be arranged to provide access to a number of other doors ( a ` corridor `). fig4 illustrates information displayed on the display device 38 of one of the workstations w1 . in fig4 two ` doors ` 100 , 102 are shown on the screen 104 of the display device . the basic idea of a door has been described in ` rooms : the use of multiple workspaces to reduce space contentions in a window - based graphical user interface ` ( acm transactions on graphics , vol . 5 , no . 3 , july 1986 , pages 211 - 243 ), and in european patent application number 90300885 . 2 . the doors 100 , 102 shown in fig4 are labelled ` fred ` and ` mtg ` respectively , and can be used by the operator of workstation w1 ( jim ) to initiate communication with fred &# 39 ; s workspace or the meeting workspace . in operation , one of the doors 100 , 102 is selected by jim , by for example positioning a mouse - driven cursor 106 over the door and operating a mouse control button . alternatively , if a touch screen is used , jim may simply touch the part of the screen 104 corresponding to the door . the single user interface represented by the door allows jim to perform one or more of the following : a ) to interrupt fred or the occupiers of the meeting workspace to attract attention ; b ) to establish an audio channel for communication to or with the selected workspace ; c ) to establish a vision channel for communication to or with the selected workspace ; and thus a single door can be arranged to provide a number of general services associated with establishing environments for cooperative working between two or more users . when a door ( say , door 100 corresponding to user ` fred `) is selected , the user of w1 (` jim `) is presented with a multiple choice menu . an example 110 of such a menu is shown in fig5 . this shows a full set of menu items . any particular user may not be allowed to exercise all the choices shown . usually choices which are currently not allowed would either be grayed - out or not presented on the menu . normally one of the menu choices , usually ` enter `, would be treated as the default and activated by , for example , a mouse ` double click `. the exact mechanism for this would be determined by the user interface style employed . using for example a mouse driven cursor or a touch screen , the user can select one of the options 112 - 130 shown on menu 110 . these are : 112 enter : this command initiates full , two way , audio and visual communication with fred ; 114 view : this command provides two way visual communication with fred ; 116 talk : this command initiates two way audio communication with fred ; 118 observe and talk : this command allows the user to ` observe ` ( see below ) and also to talk with fred ( see above ). 120 observe : this command initiates ` read only ` audio and visual communication with fred . jim can see and listen to events happening in fred &# 39 ; s environment . he cannot create an event or speak to fred ; 122 peep : this command is similar to ` observe `, but only allows visual access to the selected workspace . one application of this facility would be to access bulletin board notices ; 124 hear : again , this is similar to ` observe `, but only allows audio access to fred &# 39 ; s environment . this could be used if jim wished to keep a listening watch on a meeting while he continues to work in his own environment ; 126 interrupt : jim is able to create an attention interrupt in fred &# 39 ; s environment . this would cause a message ( either visual or audio or both ) to be emitted in the environment , such as : 128 query : this initiates a dialogue with the agent controlling fred &# 39 ; s environment . for example , jim may wish to find out who is working in the environment without disturbing it , or make an enquiry about the machine resources being used there ; 130 control : this allows the ` owner ` of the door to control various attributes of the door , such as whether particular users can enter or observe the workspace corresponding to that door . the control option can also be used in real time , for example to expel a user from the workspace or to prevent further access for a period of time ( to ` lock ` the door ). the control option will be described in more detail below , with reference to fig7 a to 7d . fig6 illustrates how one user can transmit , or ` mail ` a data object 150 such as a data or program file to another workspace . the user simply positions a mouse driven cursor 106 over the object and ` drags ` the object to the door ( that is , he holds down a mouse button while moving the cursor over the required door ). when the user releases the button , the data object is mailed to the workspace corresponding to that door . this is , of course , subject to the user having privilege to send data objects to that workspace . fig7 a to 7d show the access options which can be set by the owner of a window when the ` control ` command 130 is selected . the access options vary between complete access for the owner , down to very limited access to the workspace for a complete stranger . fig7 a shows a profile defining the access which the owner of the door has allowed himself . the owner &# 39 ; s profile gives him full access to his public workspace and allows him to pass directly through to his private workspace . he is also able to control and edit the profiles defining other users &# 39 ; access to his rooms . fig7 b shows a list of users who are allowed to peep at the owner ; s public workspace ( that is , they cannot interact visually with it ). they are allowed direct audio access to the owner &# 39 ; s private workspace and in this case the agent associated with the public workspaces passes the request onto the agent which is associated with the private workspace . this allows certain communications to be forwarded to users who are not currently working in their public workspace . removal of the name of a user would prevent that user entering the workspace . if he were present at the time his name was removed , he would be expelled immediately . fig7 c shows a set of users who are not allowed to progress beyond the owner &# 39 ; s public workspace . they are allowed restricted ( peep only ) visual access to the public workspace . finally , fig7 d shows the very restricted access given to any user whose name does not appear on any of the other profiles ( that is , a stranger ). in this example , such users are not allowed visual access at all , and any communication from them including an interrupt request is placed in an ` in - tray ` for the owner to examine later . fig8 shows a typical profile for a meeting workspace . all users are allowed full access to the workspace , including control of profiles . fig9 illustrates a profile for a workspace which is dedicated for use in broadcasting information to other users . any user can have ` read only ` audio and visual access to the workspace . they cannot control the workspace profiles . this workspace will not accept mail from users ; any attempt to do so will cause the mail to be rejected from the workspace and returned to the sender . the system can be arranged so that the menu options 110 given to the user when he selects a door depend on the access privilege which the user has to the workspace corresponding to that door . for example , the full menu as illustrated in fig5 would be given to a user such as alan or charlie ( fig7 a ), whereas a menu comprising only the options ` talk `, ` hear `, and ` interrupt ` would be presented to a stranger selecting the workspace . when a user selects a door corresponding to a particular workspace , the agent controlling access to that workspace performs a number of steps . these steps are shown schematically as a flowchart in fig1 . the flowchart in fig1 starts 300 with the user selecting a door controlled by the agent . at step 302 the agent establishes the identity of the user . this can be by requesting the user to input a secret password identifier or a non - secret user identifier , or simply by polling the user &# 39 ; s workstation . at step 304 the agent checks the user &# 39 ; s identity against the access privilege profiles for the workspace ( such as those shown in fig7 a to 7d ) and determines the level of access privilege to be assigned to that user . in the present embodiment the access profiles include a default ` stranger ` profile allowing very restricted access to anyone not specifically named in one of the other profiles . in step 306 the agent then grants access for the user in accordance with the privileges determined in step 304 . the agent then supervises communication between the user and the workspace ( step 308 ) until the user leaves the workspace ( step 310 ) or the owner of the workspace ejects the user from the workspace ( step 312 ). in either of these cases communication is stopped at step 314 . this example is easily extended to cater for door requests which have some priority attached . a note posted onto a door might have a ` priority label ` attached by the sender ( priority = 99 , or urgent ). this label would be inspected by the door agent and , according to predefined profile tables a different action might be taken : urgent notes might be presented immediately in the workspace , rather than by being filed in an intray . a user making a request for a workspace interrupt would be queried to determine the priority of the interrupt . only urgent or high priority interrupts would be allowed . lower priority interrupts would either be rejected or placed in a pending state according to previously specified profile tables . while the invention has been described in terms of a preferred embodiment in a specific system environment , those skilled in the art recognize that the invention can be practiced , with modification , in other and different hardware and software environments within the spirit and scope of the appended claims .