Kind of. There's still a lot of work to do. OAuth and SAML are quite common, but they cannot federate capabilities; it is not trivial to issue somebody a capabi

Kind of. There's still a lot of work to do. OAuth and SAML are quite common, but they cannot federate capabilities; it is not trivial to issue somebody a capability to act on your behalf without an entire infrastructure of assistant services and trusted providers. That said, each decade looks better than the last, but I still encounter the myths covered in the paper, especially incorrect beliefs about revokation, on a regular basis.