See "Split Capabilities for Access Control" at http://www.hpl.hp.com/techreports/2001/HPL-2001-164R1.html
The only implementation of this model was the ClientUtility.
CategorySecurity CategorySecurityModel CapabilitySecurityModel