See "Split Capabilities for Access Control" at http://www.hpl.hp.com/techreports/2001/HPL-2001-164R1.html

The only implementation of this model was the ClientUtility.
----
CategorySecurity CategorySecurityModel CapabilitySecurityModel