Consider the rule of transitive confinement. Suppose a process needs to execute a subprocess in such a way that the child can access exactly two files, one only for reading and one only for writing.
Could capabilities be used to implement this? If so, how?
Could access control lists implement this? If so, how?