Capability

Definition
A capability is a token that identifies an object and provides its holder with the permission to operate on the object it identifies. Capabilities must either be totally unforgeable or infeasible to forge by being sparse.

Examples
Some examples of unforgeable capabilities: Some examples of sparse capabilities (sometimes called password capabilities):
 * Designations of objects in the E language. Those who hold these capabilities have the permission to invoke any method supported by the designated object.
 * Designations of functions and procedures in Emily. Those who hold these capabilities have the permission to call designated functions or procedures.
 * Capabilities held by a process in capability operating systems.
 * POSIX file descriptors.
 * Designations of remote objects in E, such as  Those who hold these capabilities have the permission to invoke any method supported by the designated object.
 * Private URLs where having the URL is necessary and sufficient to use the resource. Common examples are:
 * "Confirm your e-mail address" links for website account registrations, mailing list subscriptions or opt-outs, e.g.
 * Shared private documents such as in Google Docs, Google Maps, Picasa albums, Doodle schedulers.
 * Designation of file-system sub-trees in MinorFs, such as
 * URL links to Bitcoin wallets.

An Unum can be also considered as a capability to a (replicated) object in a similar way as file descriptors of transparently replicated files by RAID are still regarded as file descriptors.

URLs as capabilities
As noted above, URLs are often used as capabilities in practice, especially when sent over e-mail. Some explicitly capability-structured systems, such as Tahoe-LAFS, use capability URLs.

A hazard to using capability URLs directly in a web browser is that many browser extensions or options may transmit URLs to a third-party server. In the worst case, this may make those URLs public. However, there is some mitigation:
 * The fragment part of a URL reference is not transmitted. If the browser supports executing JavaScript, then the capability can be placed in the fragment and transmitted only under script control, not as part of a URL.
 * The query string part is often not transmitted. (Citation needed on this one!)