Capabilities

---

A capability is permissions defined based on a user’s token, or key.

In capability-based systems, access rights are based entirely on the possession of the token, rather than who possesses it.

• Logical assets, such as applications, can share their token with other applications.
• Protects against CSRF and clickjacking unless the attacker has access to the token