Abstract: In this paper we propose a novel object-oriented analysis and design (OOAD) approach to protect shared objects in complex systems from undesirable access. Recently shared object protection is paid more attention to and several approaches are proposed. They give us good solutions to implement protection domains for shared objects. However, these approaches are applicable only when protection domains are easily found in the architecture of applications, such as secure information systems. Without this condition, it remains problem how we design protection domains and how we validate its correctness. To cope with this problem, we propose an approach to analyze protection domains from scenarios. The result of the analysis is used to check implementation.