We should have something like capability-based security, since object capabilities are amenable to more expressive interfaces than "read bytes" and "write bytes

We should have something like capability-based security, since object capabilities are amenable to more expressive interfaces than "read bytes" and "write bytes". Capability-based security also favors minimizing privilege by default instead of providing too much privilege and restricting/auditing later.