Capability Model

A classical access-control model in operating-system security that treats permissions as explicitly transferable but unforgeable tokens. Capabilities can only be passed from a parent process to a child process, and a parent cannot grant capabilities it does not itself possess, mathematically guaranteeing monotonically non-increasing privilege.