The distinction started with rings of protection which was orthogonal to processes. Roger Schell said the guy who designed the one for Intel’s 286 had security kernels like GEMSOS in mind. Here’s GEMSOS and STOP so you can see how they did that back in the 1980’s:

https://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf