Capabilities Most of these definitions are taken from the Saltzer and Schroeder paper. A Capability is an unforgeable ticket, which when presented can be taken as incontestable proof that the presenter is authorized to have access to the object named in the ticket. A capability can also be thought of as a secure pointer. In order to be useful, they must not be directly accessible in any address space available to a user process. In general, capabilities are faster to process than access control lists.
Authentication is the verification of the identify of a person making a request.
Authorization grants a principal access to certain information. An Access Matrix is a matrix with the rows representing principals and the columns representing resources. Each entry is thus an access right. A given row represents what resources a principal has access to, or its capabilities. Each row represents what principals can access a resource, essentially an access control list.