A read-only capability prohibits writing. The combination of these two constraints is functionally equivalent to the KeyKOS sensory capability. Both attributes are interpreted hierarchically in a memory context, which has the desired effect on controlling exposure across an entire memory segment. In the proposed design, a page frame holds either capabilities or data, but never both. Data references to a capability page cause suitable access violations.
Capability references to a data page similarly cause access violations.
The question of what to do about such faults remains a policy decision to be made by a keeper. A capability operation was performed to a data page. A data operation was performed to a capability page. A capability write was performed to a capability page along a mapping that is read-only. A data write was performed to a capability page along a mapping that is read-only.