To enable it again, a simple confirmation suffices to enable it for the duration of the time-out. To enable them again the user has to enter a password. Other types of capability classes are easily added to the system and they can be mixed. To guard access to data, the capability necessary to retrieve it can be stored together with the data. When the data is later retrieved, validity of that capability can be checked as described above .
Roles own zero or more capabilities and are members of one or more access control handles.
They are either enabled or disabled. For each use the role becomes disabled. Contains always the Core capability created in the access control service and no other capabilities. This requires an ach with the role object as member is available. Objects create the capabilities they need, and insert them in the appropriate roles, as in the following example.