Implementation: native handlers vs. sealed capabilities