This instance of the module will actually never run, but will deliver an access control handle to later loads of the module. A subject is authorized and granted access if and only if it owns a valid role containing the valid capability. A capability is valid if it is enabled and if it is a member of at least one enabled role owned by the caller. If the required capability is only found in disabled roles owned by the caller, the user is prompted to enabled each of these roles in turn, until she enables one of them. If the enabled role contains the capability, that capability is tested for validity.
Capabilities are members of one or more roles and are either enabled or disabled.
After that time, the capability becomes disabled. To enable it again, a simple confirmation suffices to enable it for the duration of the time-out. To enable them again the user has to enter a password. Other types of capability classes are easily added to the system and they can be mixed. To guard access to data, the capability necessary to retrieve it can be stored together with the data.