Unforgeability can be weakened systematically to unguessability: https://capability.party/philosophy/2017/07/29/unforgeable-vs-unguessable.html https://capabili

Unforgeability can be weakened systematically to unguessability: https://capability.party/philosophy/2017/07/29/unforgeable-vs-unguessable.html https://capability.party/philosophy/2017/07/29/unforgeable-v... Unfortunately, the concept of "taming", where ambient-authority systems are used to implement functionality in capability-safe systems, is often a sad and frustrating path due to massive impedance mismatch. Like you say, paths are not caps, which means that capability-safe languages on UNIX-like systems are constantly dancing to tame the OS. As usual, it would be great if you made your VM cap-aware, so that we may eventually get over this hump.