Short answer: if you know how CHERI and SoftBound do it, then Fil-C is basically like that. Long answer: let's assume 64-bit (8 byte pointers) without loss of

Short answer: if you know how CHERI and SoftBound do it, then Fil-C is basically like that. Long answer: let's assume 64-bit (8 byte pointers) without loss of generality. Each capability knows, for each 8 bytes in its allocation, whether those 8 bytes are a pointer, and if so, what that pointer's capability is. Example: char* p = malloc(64); This will allocate 64 bytes. p's capability will know, for each of the 8 8-byte slots, if that slot is a pointer and if so, what it's capability is. Since you just allocated the object, none of them have capabilities. Then if you do: *(int**)(p + 8) = malloc(sizeof(int)); Then p's capability will know that at offset 8, there is a pointer, and it will know that the capability is whatever came out of the malloc. Hence, each capability is dynamically tracking where the pointers are. So it's not a static type but rather something that can change over time. There's a bunch of engineering that goes into this being safe under races (it is) and for supporting pointer atomics (they just work).