Unlike the ObjectCapabilityModel, this model is discretionary. (See the discussion of "discretionary" models in ParadigmRegained.)
See CapabilityMythsDemolished, CapabilitySecurityModel
CategorySecurity CategorySecurityModel