FWIW, for those coming across this thread later: There has been some research on these topics (of course). I asked the `cap-talk` list to jog my memory, and rec

FWIW, for those coming across this thread later: There has been some research on these topics (of course). I asked the `cap-talk` list to jog my memory, and received pointers to the following interesting starting points: - "Design of the EROS Trusted Window System", Shapiro, Vanderburgh Northup and Chizmadia. USENIX Security 2004. https://www.usenix.org/legacy/publications/library/proceedings/sec04/tech/full_papers/shapiro/shapiro.pdf https://www.usenix.org/legacy/publications/library/proceedin... - "A Capability Based Client: The DarpaBrowser", Stiegler and Miller. Technical Report, June 2002. http://www.combex.com/papers/darpa-report/html/ http://www.combex.com/papers/darpa-report/html/ The Shapiro et al. paper discusses many of the issues brought up in this thread, along with the solution they chose for the actual working software system they had implemented.