Glossary
Capability
In a capability-based model, holding the token itself is what grants access to the specific resource it names — there is no separate lookup against an access list tied to the holder's identity. This has an appealing property: a capability can be passed to another party for a narrow purpose without granting that party any of the holder's other permissions, because the capability only ever names the one resource.
The tradeoff is that revocation becomes harder to reason about: because the capability itself is the permission, taking it back means finding and invalidating every copy, rather than simply changing a permission entry that everyone consults centrally.