What Is a Capability-Based Security Model?
From the earlier reference collection. Read the current software blog.
A capability is an explicit reference that combines access to a resource with authority to perform some operations. This model encourages narrow permissions and makes authority easier to trace.
Authority travels through references
In a capability-based design, code gains access to a resource by receiving a reference that permits particular operations. Possessing the reference is part of what grants authority. A component that receives a read-only handle to a file can inspect it without automatically gaining permission to rewrite or delete it.
This differs from relying only on a global name and a separate ambient permission check. With ambient access, code may be able to reach resources simply because they exist in the process environment. Explicit references make dependencies visible: if a function receives a storage handle, its ability to use that storage is apparent in its inputs.
Make permissions narrow
Suppose a report generator needs to read a directory of published measurements and write one output file. It does not need administrator access to the host, nor does it need permission to alter the source data. A capability-oriented design can pass it a read handle for the input and a separate write handle for the output.
Narrow authority limits the damage of mistakes and makes review more concrete. A useful question is: what is the smallest set of operations this component needs? The answer can shape API design, sandbox settings, and how references are shared among components.
Delegation needs care
A component that holds a capability may pass it to another component. This can simplify collaboration: a coordinator can give a worker access to one job’s temporary directory without granting access to every user’s files. But delegation also means authority can spread, so the system needs clear rules for who may pass which references and how long they remain valid.
Revocation can be difficult if a capability is an ordinary reference copied in several places. Systems may use indirection, leases, or process termination to limit ongoing access, but those details depend on the design. Do not assume that deleting one variable revokes every copy elsewhere.
Design interfaces around granted authority
A capability model works best when APIs accept the resources they need rather than reaching for global state. Keep interfaces explicit, give each component only the references it requires, and document whether those references can be shared or retained. This improves both security reasoning and ordinary testability: a test can supply a limited fake resource.
Capabilities do not eliminate bugs or policy decisions. They offer a way to structure authority so that access is visible and constrained. When the reference itself carries meaningful permission, code review can examine not only what a component does, but what it is able to do at all.