Once a capability for a segment has been given to a user, there is no way to take that capability away from the receiving user. No mechanism has been provided to control the propagation of access. E.g., once Smith has been given the capability of one of Doe's segments, there is nothing to stop Smith from giving it to other users. It is very difficult to determine exactly which users share a segment due to the uncontrolled propagation of shared segment access. An access control list system on top of a capability system See Figs.
Memory is still divided into variable-size segments.
Each access controller is identified by a unique id. The paper says that the access controller is protected but does not say how. The memory system then checks if the user is in the segment's access control list and if she is allowed the requested access. If both checks succeed, the segment's addressing descriptor contained in the access controller is used to perform the requested access on the memory location. To revoke a user's access to a segment, that user's access rights may be modified in the segment's access control list.