David Wagner Object capabilities for security. 1-2 2006 PLAS http://doi.acm.org/10.1145/1134744.1134745 conf/pldi/2006plas db/conf/pldi/plas2006.html#Wagner06