Object-capability model