Capsule documents do not have direct access to the file system by default, and accessing the internet also requires separate authorization.