tweaking designs; decided to model embedded capability strings as cryptographically sealed values to mostly keep them out of AO