Ten15: A Capability-based Operating System.

"Flex was a capability architecture and operating system with a graphical user interface, unlike any other computer system I've ever heard of! The capability architecture meant that programs did not run in a flat memory space, as we take for granted these days. Instead a program consisted of a number of memory objects, which in Flex could range in size from one integer, to the whole of physical memory. The memory objects are referred to by "pointers", and it is these pointers that are called capabilities. However capabilities were much more than just pointers. It is impossible to create (or forge) a capability without asking the system for a new object, and it is impossible to access memory that was not pointed to by one of the capabilities currently 'owned' by the program... ...In Flex, capabilities were visible in the user interface, and could be mixed freely with normal text stored in a "text object", or "Edfile". In fact, a "text object" was simply a capability to an array of lines; each line was an array of "glyphs"; and each "glyph" was either an array of characters..."