Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Capability-based security makes an AI agent prove what it is allowed to do before any tool call runs. Instead of trusting a model’s natural-language plan, the agent emits typed code; a compiler and execution harness check that code against explicit capability values for files, APIs, processes, databases, and delegated agents. A request that lacks the required capability, attempts to forge one, or carries classified data into an unauthorized effect is rejected before execution. This does not make an agent universally safe: every meaningful effect must pass through the harness, and identity, logging, revocation, and runtime containment remain necessary. It does, however, relocate a critical security decision from a probabilistic model to deterministic enforcement.
What problem does a capability layer solve for AI agents?
Modern agents can read project files, call APIs, launch processes, query databases, and delegate work to other agents. Prompt injection, hallucinated plans, and accidental misuse can turn that breadth into unauthorized effects. A model may be instructed not to disclose a secret yet still follow text embedded in a document, infer a dangerous command, or choose an over-broad tool.
As an Amazon Associate I earn from qualifying purchases.
Traditional allowlists and blocklists operate at a coarse boundary. An allowlist might permit a whole file tool or API, while a blocklist tries to anticipate every dangerous argument. Interactive confirmations interrupt workflows and can produce approval fatigue. None of these mechanisms alone establishes that a secret read in one step cannot flow into a later, unauthorized output.
A capability layer narrows the authority available to generated code. A capability is an explicit program value representing a permitted effect, such as writing to one repository path or invoking one API operation at one destination. Code must receive and pass that value to exercise the effect. Authority is no longer an ambient property of the model’s session.
#1 Best Overall
How is a capability different from an ordinary agent permission?
An ordinary permission is usually an identity-level rule: an agent, user, or service account may access a resource. A capability is a concrete, passable reference to a bounded authority. Possessing the value is necessary to perform the operation, and the value can be attenuated, scoped, logged, and revoked.
- Permission: a policy statement evaluated against an identity, often with broad resource scope.
- Capability: an unforgeable value that names the allowed effect and is supplied explicitly to the code that needs it.
- Attenuation: deriving a child capability with less authority, such as one endpoint from an API client that can reach many endpoints.
- Delegation: passing only that reduced value to a child agent; the child cannot expand it into the parent’s original authority.
The distinction matters when an agent composes tools. A planner can hold a read capability while a separate worker receives a write capability limited to a generated-output directory. Neither component automatically receives the other component’s rights.
Free tools Windows power users keep installed
One-click scans. No signup required.
How does the typed execution boundary work?
The design described in the tacit (Tracked Agent Capabilities In Types) paper uses Scala 3 with capture checking. The model proposes intentions as Scala code rather than issuing unrestricted tool calls. Generated snippets are compiled and checked, then executed through a capability library that mediates files, processes, networks, and sub-agents.
- Model proposes code. The model expresses a plan as calls to typed facades, not arbitrary shell commands or raw network clients.
- Compiler tracks captures. Scala’s capture checking records which capabilities a computation may use. A function that requires a file-write capability cannot be treated as pure code that has none.
- Harness checks the effect budget. Missing capabilities, forged values, or effects outside the approved scope cause compilation or guard failure.
- Runtime mediates the operation. Even checked code reaches an external resource through the capability library, where destination, parameters, token status, and policy can be rechecked.
- Results remain controlled. Sensitive values can stay wrapped across turns instead of being inserted as plaintext into the model’s conversation context.
The paper summarizes the shift this way: “When agents express their intentions as typed code in a capability-safe language (here, Scala 3 with capture checking), the burden of proof shifts from the model to the compiler.”
This is not a claim that a compiler can see every real-world risk. It is a claim about where a specific class of authorization decisions is made: code that cannot obtain a capability cannot invoke the corresponding effect, regardless of whether the code was generated by a careful engineer or a confused model.
What are capability safety, completeness, and local purity?
These three properties describe the minimum design target for a useful capability system.
Rank #2
Capability safety
Capabilities must be unforgeable, and code must not omit a capability that an effect requires. A generated snippet cannot manufacture a value that grants access to a different repository or API destination. The type checker should reject code whose declared effect budget is insufficient.
Capability completeness
Every safety-relevant external effect must be reachable only through a capability. If the harness guards file writes but leaves an unrestricted subprocess, environment-variable reader, or socket available, that unguarded channel becomes an escape route. Inventorying effects is therefore as important as defining token types.
Local purity
Some computations should carry no capabilities at all. A pure transformation can parse, sort, or summarize a value without reading a file, opening a network connection, or launching a process. The tacit design applies this idea to classified values: a computation that receives a wrapped secret can be required to hold no capabilities, preventing it from performing an external effect or leaking the value through an unauthorized path.
The paper states the intended guarantee precisely: “The type checker enforces that code cannot forge access rights, cannot perform effects beyond its budget, and cannot leak information from pure sub-computations, regardless of whether the code was written by a diligent engineer or hallucinated by a misaligned model.”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Can capability tokens prevent prompt-injection damage?
They can prevent many unauthorized effects that a prompt injection tries to induce, but they cannot eliminate every consequence of manipulated instructions. If injected text tells an agent to upload a credential, the upload fails when the generated code lacks a capability for the destination or for reading the credential. If the agent already has a capability that legitimately permits the upload, the token system does not decide whether the requester’s intent was malicious; scope and policy must be designed correctly.
Information flow is the crucial test. A system that only checks the final API call may still allow a secret to be read, placed in an intermediate string, and sent later through an approved-looking channel. Wrapping classified values and requiring pure transformations addresses that path by making sensitive data’s permitted operations explicit. Runtime containment, output filtering, and downstream rechecks remain useful defenses for failures that occur outside the type system.
How do I design scoped capabilities for files, APIs, and child agents?
Start with the smallest operation the workflow needs, then encode that operation and its scope in the capability type or token.
Files and repositories
Represent a repository or directory as a capability with read, write, or append authority separated. A build worker might receive read access to source files and write access only to a temporary output directory. Avoid passing a general filesystem handle or an unrestricted shell process.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesNetwork APIs
Bind a capability to an HTTP method, host, path pattern, and parameter constraints. “POST to the deployment endpoint with this project identifier” is safer than “use the network.” Recheck the destination at runtime so a token cannot be replayed against a different host.
Processes and databases
Expose approved operations through typed wrappers. A database capability can limit a query family or schema, while a process capability can identify an executable, fixed arguments, resource limits, and whether child processes are forbidden. Do not expose a generic command interpreter as a back door.
Delegated agents
When a parent agent delegates, derive a narrower child capability with an explicit lifetime and scope. The child should receive only the value required for its task, not the parent’s token set. Delegation metadata should identify the parent, child, purpose, and correlation ID.
What implementation steps create a capability-safe agent?
- Inventory effects. List every tool, library, plugin, environment variable, file path, network destination, process, database, and sub-agent reachable from the workflow. Include indirect channels such as temporary files and standard output.
- Define capability types. Create separate types or token classes for files, network destinations, processes, databases, and delegated agents. Encode operation and scope, not merely resource names.
- Build typed facades. Replace unrestricted shell and API clients with wrappers that accept the corresponding capability value. Make the unwrapped primitive unavailable to generated code.
- Compile in a restricted subset. Parse model output as code, compile it with capture checking, and reject snippets that import forbidden libraries, use undeclared effects, or exceed resource limits.
- Protect classified data. Keep secrets in wrappers such as
Classified[T]. Permit only explicitly approved pure transformations, and prevent automatic conversion to a string that could enter the conversation context. - Add deterministic runtime guards. Check token validity, destination, arguments, quotas, and expiration immediately before the effect. A successful compilation is not a substitute for a live policy check.
- Instrument every action. Log the principal, capability scope, resource, action, decision, timestamp, and correlation ID. Capture denied attempts as well as successful calls.
- Test incident controls. Exercise a kill switch, token invalidation, child-token revocation, and downstream credential rotation. Verify that already-running workers lose access when policy requires it.
How should revocation, identity, and governance work?
Technical narrowing is effective only when someone owns the authority. Microsoft guidance recommends a unique dedicated identity for each agent, a named owner, a documented purpose, approved data access, aggregate-permission review, deny-by-default tools and integrations, detailed action and scope logs, tested revocation, and re-review after material workflow or environment changes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
Use short-lived tokens for high-impact operations and require downstream systems to re-check status rather than trusting a token that was valid at issuance. A central registry can map each capability to its owner, purpose, data classification, expiration, and parent delegation. Revocation should invalidate both the registry entry and any cache used by the execution harness.
Broader governance guidance treats agents as systems that access data, make decisions, and act across business systems with delegated authority. A centralized, enforceable, auditable baseline should cover identity, lifecycle, data governance, security engineering, development standards, and observability. In practice, that means reviewing a workflow when its tools, data sources, model, or surrounding environment changes—not only when code changes.
How does this approach compare with gateways, sandboxes, and human approval?
No single control covers every failure mode. The useful comparison is where enforcement occurs, what information-flow guarantees exist, how finely authority is scoped, how revocation works, and what utility cost the workflow pays.
| Approach | Enforcement point | Information-flow coverage | Granularity | Typical utility cost |
|---|---|---|---|---|
| Capability-typed harness | Compiler plus deterministic runtime guard | Can constrain classified values in pure computations when wrappers and capture checking are applied | Resource, operation, parameter, destination, and delegation scope | Code-generation constraints and integration work |
| Runtime policy gateway | Deterministic check at each tool or API call | Strong for visible calls; weaker if data moves through an unobserved channel | Request, destination, parameter, quota, and token lifetime | Policy latency and gateway coverage |
| Sandbox | Process, container, or operating-system boundary | Limits reachable resources; does not by itself explain whether an allowed output contains a secret | Filesystem, network, process, and resource limits | Isolation overhead and compatibility work |
| Human approval | Person confirms a proposed action | Depends on what the reviewer can see; vulnerable to fatigue and ambiguous context | Usually action-level, with variable detail | Latency, staffing, and approval fatigue |
A layered design is usually stronger: typed capabilities establish what generated code may request, a runtime gateway rechecks live policy, a sandbox contains implementation failures, and human approval is reserved for exceptional or high-impact actions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What does Capframe add as an implementation reference?
Capframe is a separate open-source project organized around three modules: “Find” the tool surface and injection gaps, “Bind” authority with scoped revocable capability tokens, and “Guard” every call with deterministic policy and no language model in the security decision path. It is useful as a concrete reference for structuring discovery, token issuance, and enforcement. Its deployment, licensing, and any commercial terms should be evaluated separately for a particular environment.
What evidence supports the capability-layer claim?
The tacit proof of concept reported no significant loss in task performance in its experiments while preventing unsafe information leakage and malicious side effects. That qualitative result is attributed to Odersky, Zhao, Xu, Bračevac, and Pham in CAIS 2026. It should be read as evidence from a proof of concept, not as a universal benchmark for every model, language, or workload.
There is no independent market-size or incident-rate statistic needed to establish the core engineering argument here. The practical question is whether a proposed deployment can route all relevant effects through enforceable capabilities and demonstrate the claimed controls with tests and logs.
Where can this design fail, and how do I troubleshoot it?
- A denied call appears inexplicable: inspect the compiled capture set, token scope, destination normalization, and parent delegation chain. The model’s textual explanation is not authoritative.
- A secret still appears in output: trace every conversion from
Classified[T], including logs, exceptions, metrics, and error messages. Add sink checks and remove implicit stringification. - An escape route remains: rescan imports, subprocess APIs, temporary directories, environment access, standard streams, and plugins. Capability completeness fails if even one effect bypasses the harness.
- Revocation is slow: shorten token cache lifetimes, require a live status check at the effect boundary, and test workers that hold a token while an incident response is in progress.
- Developers bypass the wrapper: enforce the restricted runtime and dependency policy in the build pipeline, then monitor for new tools or integrations before they become reachable by agents.
Frequently Asked Questions
Do capability systems require every agent to be written in Scala?
No. Scala 3 with capture checking is the language used by the tacit implementation, but the architectural requirement is language-independent: generated intent must pass through a type-aware or otherwise deterministic boundary, and every external effect must require an unforgeable scoped value. Other languages can implement equivalent wrappers and checks with different assurance levels.
What happens to an agent task when one capability is missing?
The safest behavior is a typed or policy denial that returns a structured error without executing a fallback shell command or silently broadening scope. The orchestrator can ask for a new plan, request an explicitly approved delegation, or stop the task while preserving the denied-action log.
Can a revoked capability stop an operation that is already running?
Only if the underlying effect supports interruption or periodic authorization checks. Revocation reliably prevents new uses when the harness checks token status, but long-running jobs also need cancellation hooks, downstream credential invalidation, and resource cleanup.
How should capability logs be protected?
Treat logs as security-sensitive data: separate decision metadata from payloads, avoid recording classified values, restrict readers by role, retain correlation IDs for reconstruction, and monitor for tampering. Logging a token scope and action is generally more useful than copying the entire model conversation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
