The use of child packages to encapsulate derived tagged types and their operations should protect the state variables of the parent type that are to be manipulated by the parent operations alone. This protection can be achieved through the declaration of a data component of a limited record type, previously declared with no attributes and an access type discriminant that visibly points to an incomplete definition. The details of the data component (either scalar or composite, depending on application), whose full type declaration is in the parent package body, is accessible only through the discriminant from within the package body. This mechanism provides full information hiding of the details and maximum protection of the contents of those instance variables.
/lp/association-for-computing-machinery/protecting-internal-state-variables-from-subclasses-zpRFurmPQj