We can give each subject a list of pairs: (which object, what access)
Each of these pairs is a capability similar to a file descriptor. We can also store capabilities with each process instead of user, enabling them to be fine-grained and dynamic.
Unforgeable token of authority on some object, possessing a valid reference is enough. Similar to keys on a keyring:
- each key has a distinct authority - can be fine-grained\
- to open a door you have to pick a key - designated, not ambient
- more than 1 key might open the same door differently
The validity check can be distributed using cryptography.