This isn't anything new. It is, in fact, described in many places.
Permissions can, most generally, be described as a matrix of objects and
security domains. This matrix is large and, generally, highly regular.
If we slice the matrix up and associate each column with an object, we
call it an "access control list". If we slice the matrix up and
associate each row with a security domain, we call it a "capability."
These can be, and often are, daisy-chained, so that an access control
list can contain "all possessors of capability X", for example.
Groups in Unix are, in fact, a form of capabilities.
-hpa
-
