The tool parses its command line, claims the capabilities it needs, drops everything else, then runs.

Or the language it’s written in allows writing a function that takes a recursive enumerate capability on a directory plus a write capability to stdout.

A while back I sent a brain dump email to LKML about “path capabilities”. Maybe I’ll try to implement it.

Probably on a directory read basis. I’d need to give it more thought.

Thanks for the thoughtful question!