Capability-Based Security
Capability security grants authority by handing the caller an unforgeable reference to a specific resource, so authority is bounded by what you hold, not by who you are or what process you run in.
Definition
A capability is an unforgeable token that simultaneously designates a resource and the authority to perform specific operations on it; possession of the capability is the authority, and it can be passed to delegate precisely that authority without granting anything more.
Context and scope
Applied in capability-based operating systems, object-capability languages, and cloud IAM where a signed URL is a capability to one object for one operation.
Common misconceptions
- Capabilities are just tokens — the unforgeability is the essence; a guessable string is a reference, not a capability
- Capability security requires a capability OS — object-capability discipline can be enforced in any language that forbids ambient authority and constrains references
Anti-patterns
- Storing capabilities in a globally readable location, collapsing the model back to ambient authority
- Making capabilities non-transferable, removing the delegation power that is the model main advantage over ACLs
Related concepts
Authoritative source
What it is
A capability is an unforgeable token that simultaneously designates a resource and the authority to perform specific operations on it; possession of the capability is the authority, and it can be passed to delegate precisely that authority without granting anything more. Applied in capability-based operating systems, object-capability languages, and cloud IAM where a signed URL is a capability to one object for one operation. The threat model determines which controls apply: preventive controls block exploits, detective controls surface violations, and corrective controls restore integrity after an incident.
How it works
Effective implementations layer controls so that no single bypass compromises the asset. Verification happens at trust boundaries, not just at the perimeter. Cryptographic primitives are selected for the concrete property needed — unforgeability, indistinguishability, or non-malleability — and never composed ad hoc. Failure modes fail closed: a verification error denies rather than allows.
When to enforce and pitfalls
Enforce wherever an attacker can influence input that crosses a trust boundary. Common pitfalls include treating obfuscation as a control, relying on secrecy of the algorithm rather than the key, and auditing the happy path while ignoring error-handling branches where bypasses often hide. Rate-limit and log every verification attempt so brute-force and oracle attacks become visible.