The concrete rules I'd give you are in http://en.wikipedia.org/wiki/Object-capability_model http://en.wikipedia.org/wiki/Object-capability_model -- note that in

The concrete rules I'd give you are in http://en.wikipedia.org/wiki/Object-capability_model http://en.wikipedia.org/wiki/Object-capability_model -- note that inabilities are important, not just abilities. I'm a great fan of the thesis that's the first reference, which also gets into distributing the model over the network. I couldn't say if Kay would agree.