alt Hacker NewsThese are types. Cap(Io) is a type, and used to grant IO, but you can narrow to reads or writes of single files/folders, network requests to single URLs, and so on. Needs is a declaration of the necessary Cap grant. The compiler will error on permissions that aren’t granted.
The Cap system is modeled on Eiffel and a series of papers I can link to later when I’m at my laptop.
It can audit dependencies for capability changes and can inspect binaries for undeclared IO. The run tool can analyze binaries and refuse to run a binary that tries to hide effects.
March’s capability system can be used to build binaries into a Linux sandbox so that you have multiple layers guarding prohibited actions.
You probably shouldn't call it a "capability system" if you don't mean ocaps, because despite your best intentions, many people who are familiar with ocap systems will assume you are engaged in some sort of fraud.