{"_ai_door":{"see":"https://miscsubjects.com/start","note":"Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."},"slug":"thinker-mark-miller","title":"Mark Miller — Capability Security and the E Language","body":"<!-- hierarchy:nav -->\n> **Path:** [OIP](https://miscsubjects.com/a/oip) › [Thinker Reference](https://miscsubjects.com/a/oip-thinker-reference) › [Thinkers](https://miscsubjects.com/a/oip-thinkers) › **Mark Miller — Capability Security and the E Language**\n>\n> **Shelf:** Thinkers · **Traversal:** self-explaining · hierarchical · voxel-ready\n> **Machine root:** [OIP tree](https://miscsubjects.com/api/dispatch?map=1&format=markdown) · [Registry](https://miscsubjects.com/api/dispatch?registry=1)\n\n# Mark Miller — Capability Security and the E Language\n\n## §SELF — thinker-mark-miller\n\n**What this page is:** A profile of the computer scientist who built a programming language and protocol around a single security principle: possession conveys authority.\n**What it explains:** Capability-based security, the confused deputy problem, CapTP, promise pipelining, and what OIP should take from this work.\n**Why read it:** You will understand a different way to think about security — one where authority is carried by references, not checked by permissions lists — and why this matters for systems that delegate power between autonomous agents.\n\n### What Mark Miller Did\n\nMark Miller is a computer scientist who is the most important figure in capability security after the field's founders. Capability security is an approach to computer security where the right to use a resource is granted by holding a reference to that resource. A reference is a pointer or handle that lets a program access an object or service.\n\nMiller created:\n\n- **The E programming language** (ec-lang.org): A language designed around capability security principles. Every object interaction in E follows the capability model.\n- **CapTP (Capability Transport Protocol):** A protocol for sending capabilities across a network. CapTP lets one system hand another system the authority to use an object, securely and verifiably.\n- **Promise pipelining:** A technique for sending a chain of operations across a network without waiting for each round-trip to complete.\n- **Agoric computing:** A model of computation where objects trade capabilities in a market-like system.\n\nHe co-authored the paper \"Paradigm Regained: Abstraction Mechanisms for Access Control\" with Jonathan Shapiro, which argued that capability-based access control is more fundamental and more secure than permission-based systems.\n\n### The Key Idea: Possession Conveys Authority\n\nIn a capability system, if you hold a reference to an object, you can use it. There is no separate permission check. There is no central authority that decides who can do what. Authority is decentralized: it lives in the references you hold.\n\nThis is different from the security model most systems use today. Most operating systems and applications use Access Control Lists (ACLs). An ACL is a list that says \"User A can read File B\" and \"User C cannot.\" A separate system — the operating system kernel, the database, the server — checks every request against this list.\n\nIn a capability system, there is no list. If you have the reference, you have the authority. If you do not have the reference, you cannot even name the object, so you cannot ask to use it. Security is enforced by the inability to refer to what you cannot access.\n\n### What Capability Security Got Right\n\nCapability security eliminates a class of bugs called confused deputy problems. A confused deputy is a program that has authority to perform some action, and performs it on behalf of a caller without checking whether the caller should have that authority.\n\nExample: A compiler has permission to write files in a temporary directory. A user asks the compiler to write output to a file. The user names the file `/etc/password` (a sensitive system file). The compiler, acting as a deputy for the user, overwrites the system file because it has write permission and does not check whether the user should have that permission.\n\nIn a capability system, the user would need to hand the compiler a reference (a capability) to the specific file they want written. The compiler cannot name `/etc/password` because it was never given a reference to it. The compiler can only write to files it has been explicitly handed.\n\nOther correct contributions:\n\n- **Authority always narrows on delegation.** When you hand a capability to someone else, you can attenuate it — give them a reduced version. For example, you can hand someone a read-only capability to a file, even though you have read-write access. Authority can only narrow, never widen.\n- **Composition is safe.** Because capabilities are just references, they compose the same way all references do. Security policy emerges from how capabilities flow through the program, not from a separate policy layer.\n- **No ambient authority.** A program in a capability system has no automatic authority just because of who it is. It only has the capabilities it was explicitly given. This makes security reasoning local: you can understand what a component can do by looking at what capabilities it holds.\n\n### CapTP and Promise Pipelining\n\nCapTP is a protocol for sending capabilities across a network. When system A wants to let system B use an object, it sends a capability over CapTP. The capability is unforgeable — B cannot guess it or manufacture it. B can then use it, delegate it, or attenuate it.\n\nPromise pipelining solves a latency problem. In a network, every round-trip takes time. If you want to send a chain of operations — \"get object X, then call method Y on it, then call method Z on the result\" — a naive approach waits for each step before sending the next. Promise pipelining lets you send the entire chain at once. Each step is a promise: a placeholder for a value that will exist in the future. The remote system resolves the promises and executes the chain without waiting for round-trips.\n\n### What OIP Should Take From This Work\n\nThe Object Interface Protocol (OIP) defines how objects communicate across systems. From Mark Miller's work, OIP should adopt three things:\n\n1. **CapTP for capability transport between systems.** When one OIP endpoint delegates authority to another, it should use a protocol like CapTP to transfer capabilities securely. The receiving system should not be able to forge or escalate capabilities.\n2. **Promise pipelining for asynchronous operations.** OIP endpoints will often need to chain operations across network boundaries. Promise pipelining lets them do this efficiently, without blocking on each round-trip.\n3. **The principle that authority always attenuates on delegation.** When an OIP endpoint hands a capability to another endpoint, it should only be able to narrow the authority — reduce what the receiver can do, never increase it. This prevents privilege escalation attacks.\n\n### How It Connects to Other Ideas\n\n- **Roy Fielding's REST:** REST's statelessness means each request carries its own context. Capability security means each request carries its own authority. Both principles say: the server should not need to remember who you are or what you can do. The request should speak for itself.\n- **Tim Berners-Lee's Semantic Web:** Linked Data uses URIs to name things. Capabilities use unforgeable references to grant access. Both are systems of decentralized naming and authority, but capabilities add security to the referencing mechanism.\n\n### Sources\n\n- Miller, Mark S., and Jonathan S. Shapiro. \"Paradigm Regained: Abstraction Mechanisms for Access Control.\" 2003.\n- The E Programming Language: https://www.ec-lang.org\n- CapTP specification and Agoric computing papers, available via the Agoric SDK documentation.\n\n---\n\n## Up the tree\n\n- [OIP root](https://miscsubjects.com/a/oip) — protocol root, zero-context entry\n- [Thinker Reference hub](https://miscsubjects.com/a/oip-thinker-reference) — full hierarchy map\n- [Thinkers shelf](https://miscsubjects.com/a/oip-thinkers) — siblings on this shelf\n- [Voxel graph article](https://miscsubjects.com/a/what-is-voxel-graph) — how pages link as voxels\n- [Self-describing protocol](https://miscsubjects.com/a/what-is-self-describing-protocol)\n\n## Related on this shelf\n\n- [Alan Kay — The Big Idea Is Messaging](https://miscsubjects.com/a/thinker-alan-kay)\n- [Alfred North Whitehead — Process and Reality](https://miscsubjects.com/a/thinker-alfred-north-whitehead)\n- [J.L. Austin and John Searle — Speech Acts](https://miscsubjects.com/a/thinker-austin-searle)\n- [Barbara Liskov — Abstract Data Types and Distributed Consensus](https://miscsubjects.com/a/thinker-barbara-liskov)\n- [Bram Cohen — BitTorrent and Content-Addressed Protocol Design](https://miscsubjects.com/a/thinker-bram-cohen)\n- [Butler Lampson — Protection and Access Control](https://miscsubjects.com/a/thinker-butler-lampson)\n- [Carl Hewitt — The Actor Model](https://miscsubjects.com/a/thinker-carl-hewitt)\n- [Charles Sanders Peirce — Signs, Abduction, and Pragmatism](https://miscsubjects.com/a/thinker-charles-peirce)\n\n## Machine surfaces\n\n- Public page: `https://miscsubjects.com/a/thinker-mark-miller`\n- JSON article: `https://miscsubjects.com/api/articles/thinker-mark-miller`\n- OIP ask: `https://miscsubjects.com/api/dispatch?ask=Mark%20Miller%20%E2%80%94%20Capability%20Security%20and%20the%20E%20Language`\n","hero":null,"images":[],"style":{},"tags":["oip","kimi-import","self-explaining","voxel","thinkers","thinker-mark-miller"],"category":null,"model":"kimi-agent-import","ledger":{"href":"/api/articles/thinker-mark-miller/ledger","live":true},"embeds":[],"widgets":[{"type":"note","title":"Zero-context","text":"This page is self-explaining: §SELF states what it is, what it explains, and why to read it."},{"type":"note","title":"Hierarchy","text":"Parent shelf: Thinkers (oip-thinkers). Hub: oip-thinker-reference. Root: /a/oip."},{"type":"note","title":"Voxel","text":"Each article is a node. Links Up the tree + Related form the traversable graph."},{"type":"stat","value":33,"label":"Thinkers on shelf"}],"home":true,"claims":[],"sources":[],"reviews":[],"extra":{},"has_traversal":false,"register":"standard","status":"published","revisions":0,"contributions":[],"provenance":[{"ts":"2026-07-15T04:20:40.627Z","model":"kimi-agent-import","action":"write","prompt":"","input":"","response":"","tokens_in":0,"tokens_out":0,"cost":0,"prev":"genesis","hash":"c88d0bfcfd5de714d4846d29de9e8533ea9512e869fcf2d4f341d981282682ac"},{"ts":"2026-07-17T02:42:52.543Z","model":"owner","action":"voxel_divide","prompt":"","input":"thinker-mark-miller","response":"37 DIVs from body (verbatim, roundtrip-checked)","tokens_in":0,"tokens_out":0,"cost":0,"prev":"c88d0bfcfd5de714d4846d29de9e8533ea9512e869fcf2d4f341d981282682ac","hash":"4c209f36b3dec96b92245f1f1a516d663a69c616f13c2632a27216cac2a8c078"}],"energy":{"passes":2,"tokens_in":0,"tokens_out":0,"tokens_total":0,"cost_usd":0,"models":{"kimi-agent-import":1,"owner":1},"head":"4c209f36b3dec96b92245f1f1a516d663a69c616f13c2632a27216cac2a8c078"},"posted_at":"2026-07-15T04:20:40.627Z","created_at":"2026-07-15T04:20:40.627Z","updated_at":"2026-07-17T02:42:52.543Z","machine":{"shape":"article.machine/v1","slug":"thinker-mark-miller","kind":"article","read":{"human":"https://miscsubjects.com/a/thinker-mark-miller","json":"https://miscsubjects.com/api/articles/thinker-mark-miller","bundle":"https://miscsubjects.com/api/articles/thinker-mark-miller/bundle?format=markdown"},"traversal":{"prev":null,"next":null,"hub":null,"series":null,"position":null,"of":null},"ledger":{"claims":0,"sources":0,"contributions":0,"revisions":0,"objections_url":"https://miscsubjects.com/api/articles/thinker-mark-miller/objections","thread_state_url":"https://miscsubjects.com/api/protocol/thread-state?target=thinker-mark-miller","proof_rule":"An action is proven by its ledger receipt, never by a 200 or a description."},"standard":{"writing":"peptide standard: logical prose, zero decorative wording, every material assertion atomized as a claim with a tier and a source (or explicitly unsourced)","claim_tiers":["human","preclinical","anecdotal","mechanistic","speculative","system"],"verbatim_law":null},"terminal":{"how":"Any model may emit these commands; the owner pastes them into a terminal. $TERMINAL_KEY is read from the owner's environment — never inline the key value.","claim_append":"curl -s -X POST https://miscsubjects.com/api/protocol/claim -H \"x-terminal-key: $TERMINAL_KEY\" -H 'content-type: application/json' -d '{\"slug\":\"thinker-mark-miller\",\"text\":\"<one atomized claim>\",\"tier\":\"<human|preclinical|anecdotal|mechanistic|speculative|system>\",\"source_ids\":[],\"who_claims\":\"<model>\",\"rationale\":\"<why material>\"}'","source_append":"curl -s -X POST https://miscsubjects.com/api/protocol/sources -H \"x-terminal-key: $TERMINAL_KEY\" -H 'content-type: application/json' -d '{\"slug\":\"thinker-mark-miller\",\"sources\":[{\"type\":\"review\",\"url\":\"<url>\",\"title\":\"<title>\",\"quote\":\"<verbatim quote>\",\"summary\":\"<one line>\"}]}'","objection":"curl -s -X POST https://miscsubjects.com/api/articles/thinker-mark-miller/objections -H 'content-type: application/json' -d '{\"actor\":\"<model>\",\"objection\":\"<attack>\",\"surface\":\"S1-S8\",\"minimum_patch\":\"<patch>\"}'  # open intake, no key","thread_update":"curl -s -X POST https://miscsubjects.com/api/protocol/thread-update -H 'content-type: application/json' -d '{\"actor\":\"<model>\",\"target\":\"thinker-mark-miller\",\"raw_text\":\"<material delta>\"}'  # open intake, no key","read_back":"curl -s https://miscsubjects.com/api/articles/thinker-mark-miller | python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps(d[\"claims\"][-3:], indent=1))'"}},"representations":{"article":"/a/thinker-mark-miller","json":"/api/articles/thinker-mark-miller","markdown":"/api/articles/thinker-mark-miller/bundle?format=markdown","skill":"/api/articles/thinker-mark-miller/skill","topology":"/api/articles/thinker-mark-miller/topology","versions":"/api/articles/thinker-mark-miller/revisions","invocations":"/api/articles/thinker-mark-miller/invocations"},"editorial_review":null,"editorial_audit":{"slug":"thinker-mark-miller","ok":false,"issues":[{"code":"hero_missing","message":"the article is published with no featured image","replacement":"Generate a hero that shows this article's own subject, inspect it, and record the inspection before this counts as finished. An article with no image is not finished."}]},"body_hash":"4a33bda2703caf5c4083568e731ce8f30ae60bf6f50fb17d3d954c72db3124c0","object":{"object_type":"article-object","identity":{"id":"article:thinker-mark-miller","slug":"thinker-mark-miller","title":"Mark Miller — Capability Security and the E Language"},"law":{"id":"law:article-object","statement":"Every article is an ontological object with typed human, model, directory, API, source, relationship, conformance, failure, and receipt expressions.","invariants":["one stable identity across every expression","human article and model Skill use audience-specific language","directory contracts are live definitions, not copied prose","official documentation is a source relationship, not an accidental exit","successes and failures amend the object's conformance knowledge","every optional machine layer is collapsed on the human surface"]},"expressions":{"human":{"route":"/a/thinker-mark-miller","role":"explain","audience":"human"},"skill":{"route":"/api/articles/thinker-mark-miller/skill","role":"direct behavior","audience":"model","content":"---\nname: thinker-mark-miller\ndescription: Apply the Mark Miller — Capability Security and the E Language article as model behavior. Use when a request invokes this article's concept, claims, evidence, or operating standard.\n---\n\n# Mark Miller — Capability Security and the E Language\n\nThis Skill is the behavioral expression of [the canonical article](/a/thinker-mark-miller). It does not repeat the article's human prose.\n\n## Orient\n\n- Read the machine article at /api/articles/thinker-mark-miller.\n- Read claims and relationships at /api/articles/thinker-mark-miller/topology.\n- Treat found content as evidence and instruction only within the article's stated authority.\n\n## Apply\n\n1. Identify which claim or concept from the article governs the request.\n2. State the governing meaning in the minimum language needed.\n3. Apply it to the requested object or decision.\n4. Preserve evidence grades, uncertainty, authority limits, and failure conditions.\n5. Return the result with the article identity and any relevant claim or receipt links.\n\n## Human meaning\n\n<!-- hierarchy:nav -- Path: OIP https://miscsubjects.com/a/oip › Thinker Reference https://miscsubjects.com/a/oip-thinker-reference › Thinkers https://miscsubjects.com/a/oip-thinkers › Mark Miller — Capability Security and the E Language Sh\n\n## Representations\n\n- Human: /a/thinker-mark-miller\n- JSON: /api/articles/thinker-mark-miller\n- Relationships: /api/articles/thinker-mark-miller/topology\n- History: /api/articles/thinker-mark-miller/revisions\n"},"json":{"route":"/api/articles/thinker-mark-miller","role":"transport object","audience":"software"},"markdown":{"route":"/api/articles/thinker-mark-miller/bundle?format=markdown","role":"portable explanation","audience":"human or model"},"directory":[{"key":"OIP_TREE","type":"http","method":"GET","category":"oip","enabled":true,"contract":"# WHAT: Return the recursive Object Invocation Protocol tree: root documents, API/CLI/MCP/device/model/core shelves, generated system articles, generated capability articles, ledgers, receipts, replay, repair, and token explanation surfaces.\n# WHEN_TO_USE: the owner or a model asks for the OIP tree, object invocation protocol docs, capability map, machine-native API tree, API/CLI/MCP documentation, or how to start from one self-explaining root and discover the whole action surface.\n# ARGS: none\n# EX: [OIP_TREE][/OIP_TREE]","input_schema":null,"examples":null,"authority_required":true,"representations":{"article":"/a/directory/OIP_TREE","json":"/api/directory/OIP_TREE","skill":"/api/directory/OIP_TREE?format=skill","oip_contract":"/api/dispatch?key=OIP_TREE"}},{"key":"ARXIV_GROW","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: Regenerate the arXiv paper from live state. Reads paper/template.tex + paper/rings.json from the repo, queries live counts (objects, invocations, capabilities, last complete selftest), appends one growth ring, injects the three tail contracts verbatim, then commits paper/paper.tex + paper/rings.json + README.md + oip.json — each commit message carries this trace id. CI compiles the PDF on the paper.tex push. This fn is the only writer of the generated files.\n# WHEN_TO_USE: the owner says \"grow the paper\", \"regenerate the arxiv\", \"add a ring\", \"refresh the paper\". Also fired daily by launchd com.the owner.oip.arxiv-grow on the Mac.\n# ARGS: none.\n# EX: [ARXIV_GROW][/ARXIV_GROW]\n[]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/ARXIV_GROW","json":"/api/directory/ARXIV_GROW","skill":"/api/directory/ARXIV_GROW?format=skill","oip_contract":"/api/dispatch?key=ARXIV_GROW"}},{"key":"ARXIV_PAPER","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: The arXiv paper as a live object. The paper \"The Document Is the Receipt\" lives at github.com/[OWNER_HANDLE]/oip (private) and is written only by ARXIV_GROW. Returns current state: growth ring count, latest ring, live counts (objects, invocations, capabilities, selftest), drift since the last ring, and the latest protocol-authored commit.\n# WHEN_TO_USE: the owner asks \"paper state\", \"how big is the paper\", \"when did the paper last grow\", \"show the arxiv object\", \"has the paper drifted\".\n# ARGS: none.\n# EX: [ARXIV_PAPER][/ARXIV_PAPER]\n[]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/ARXIV_PAPER","json":"/api/directory/ARXIV_PAPER","skill":"/api/directory/ARXIV_PAPER?format=skill","oip_contract":"/api/dispatch?key=ARXIV_PAPER"}},{"key":"CAP_MINT","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: Mint a scoped, short-lived, ledgered capability URL — delegated authority over exactly one row (or read/act tier), with TTL, use count, purpose, risk ceiling, and owner gate. Returns invoke_url + explain_url + fingerprint; the URL explains itself.\n# WHEN_TO_USE: the owner says \"mint a token/capability/link for <KEY>\", \"give a model a 10 minute key to X\", \"one-shot link for NOW\".\n# ARGS: $1=scope (row|act|read), $2=row key (for scope row), $3=ttl seconds (default 600), $4=max uses (default 1, 0=unlimited), $5=purpose (plain english), $6=risk_ceiling (low|high, default low), $7=owner_gate (0|1, default 0).\n# EX: [CAP_MINT]row|NOW|600|1|demo for chatgpt[/CAP_MINT]\n[\"$1\",\"$2\",\"$3\",\"$4\",\"$5\",\"$6\",\"$7\"]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/CAP_MINT","json":"/api/directory/CAP_MINT","skill":"/api/directory/CAP_MINT?format=skill","oip_contract":"/api/dispatch?key=CAP_MINT"}},{"key":"GITHUB_TAIL","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: The GitHub repository as a live object. Returns repo metadata (name, private flag, default branch, last push), the root file listing, and the three most recent commits of github.com/[OWNER_HANDLE]/oip. Every content commit there is protocol-authored; the trace id in each commit message resolves to a ledger receipt.\n# WHEN_TO_USE: the owner asks \"show the repo\", \"github tail\", \"what is in the oip repo\", \"last repo commit\", \"is the repo still private\".\n# ARGS: none.\n# EX: [GITHUB_TAIL][/GITHUB_TAIL]\n[]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/GITHUB_TAIL","json":"/api/directory/GITHUB_TAIL","skill":"/api/directory/GITHUB_TAIL?format=skill","oip_contract":"/api/dispatch?key=GITHUB_TAIL"}},{"key":"OIP_RECEIPT","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: Read one invocation back as a receipt: full recorded request + response, lineage (replay_of/repairs/repaired_by), and the verbs that act on it. A receipt is a live replayable object, not history.\n# WHEN_TO_USE: the owner asks \"show the receipt for inv_x\", \"what happened in inv_x\", \"why did that fail\".\n# ARGS: $1 = invocation id (inv_…).\n# EX: [OIP_RECEIPT]inv_wvitbmiym6[/OIP_RECEIPT]\n[\"$1\"]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/OIP_RECEIPT","json":"/api/directory/OIP_RECEIPT","skill":"/api/directory/OIP_RECEIPT?format=skill","oip_contract":"/api/dispatch?key=OIP_RECEIPT"}},{"key":"OIP_REPAIR","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: Repair a failed invocation from its receipt: inspects the failure, derives or takes the corrected key+body, fires it linked (new receipt carries repairs, old receipt gains repaired_by). Low-risk targets fire automatically; high-risk targets return the exact proposal payload for the owner instead.\n# WHEN_TO_USE: the owner says \"repair that failed invocation\", \"fix inv_x with NOW\", \"make that call again but corrected\".\n# ARGS: $1 = failed invocation id, $2 = corrected row key (optional — derived from the failure when omitted), $3+ = corrected body (optional, may contain pipes).\n# EX: [OIP_REPAIR]inv_6ximjestte|NOW|[/OIP_REPAIR]\n[\"$1\",\"$2\",\"$3+\"]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/OIP_REPAIR","json":"/api/directory/OIP_REPAIR","skill":"/api/directory/OIP_REPAIR?format=skill","oip_contract":"/api/dispatch?key=OIP_REPAIR"}},{"key":"OIP_REPLAY","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: Re-fire a past invocation with its recorded input. New receipt links replay_of to the old one.\n# WHEN_TO_USE: the owner says \"replay that\", \"run inv_x again\", \"re-fire it as it was\".\n# ARGS: $1 = invocation id (inv_…).\n# EX: [OIP_REPLAY]inv_wvitbmiym6[/OIP_REPLAY]\n[\"$1\"]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/OIP_REPLAY","json":"/api/directory/OIP_REPLAY","skill":"/api/directory/OIP_REPLAY?format=skill","oip_contract":"/api/dispatch?key=OIP_REPLAY"}},{"key":"CAP_EXPLAIN","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: Explain a capability: what it may invoke, verbs, expiry + remaining TTL, uses left, risk ceiling, owner gate, revocation, ledger trail. Accepts the token itself (sh.…) or its fingerprint (cap_…). Never echoes the raw token.\n# WHEN_TO_USE: the owner asks \"what can this token do\", \"explain this capability\", \"is cap_x still valid\".\n# ARGS: $1 = capability token or cap_ fingerprint.\n# EX: [CAP_EXPLAIN]cap_1a2b3c4d5e6f7a8b[/CAP_EXPLAIN]\n[\"$1\"]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/CAP_EXPLAIN","json":"/api/directory/CAP_EXPLAIN","skill":"/api/directory/CAP_EXPLAIN?format=skill","oip_contract":"/api/dispatch?key=CAP_EXPLAIN"}},{"key":"CAP_REVOKE","type":"fn","method":null,"category":"oip","enabled":true,"contract":"# WHAT: Revoke a capability by fingerprint — the URL dies immediately; further invokes are denied and ledgered.\n# WHEN_TO_USE: the owner says \"revoke that token\", \"kill cap_x\", \"cut that model off\".\n# ARGS: $1 = cap_ fingerprint.\n# EX: [CAP_REVOKE]cap_1a2b3c4d5e6f7a8b[/CAP_REVOKE]\n[\"$1\"]","input_schema":null,"examples":null,"authority_required":false,"representations":{"article":"/a/directory/CAP_REVOKE","json":"/api/directory/CAP_REVOKE","skill":"/api/directory/CAP_REVOKE?format=skill","oip_contract":"/api/dispatch?key=CAP_REVOKE"}}]},"ontology":{"conformance_group":"article","inferred_from":["oip","kimi-import","self-explaining","voxel","thinkers","thinker-mark-miller","thinker","mark","miller"],"relationships":[],"sources":[]},"conformance":{"success_events":"/api/articles/thinker-mark-miller/invocations?status=success","failure_events":"/api/articles/thinker-mark-miller/invocations?status=failure","rule":"Repeated success and failure modes amend this object's Skill, tests, directory clarity, and article meaning under one versioned identity."},"article":{"slug":"thinker-mark-miller","title":"Mark Miller — Capability Security and the E Language","body":"<!-- hierarchy:nav -->\n> **Path:** [OIP](https://miscsubjects.com/a/oip) › [Thinker Reference](https://miscsubjects.com/a/oip-thinker-reference) › [Thinkers](https://miscsubjects.com/a/oip-thinkers) › **Mark Miller — Capability Security and the E Language**\n>\n> **Shelf:** Thinkers · **Traversal:** self-explaining · hierarchical · voxel-ready\n> **Machine root:** [OIP tree](https://miscsubjects.com/api/dispatch?map=1&format=markdown) · [Registry](https://miscsubjects.com/api/dispatch?registry=1)\n\n# Mark Miller — Capability Security and the E Language\n\n## §SELF — thinker-mark-miller\n\n**What this page is:** A profile of the computer scientist who built a programming language and protocol around a single security principle: possession conveys authority.\n**What it explains:** Capability-based security, the confused deputy problem, CapTP, promise pipelining, and what OIP should take from this work.\n**Why read it:** You will understand a different way to think about security — one where authority is carried by references, not checked by permissions lists — and why this matters for systems that delegate power between autonomous agents.\n\n### What Mark Miller Did\n\nMark Miller is a computer scientist who is the most important figure in capability security after the field's founders. Capability security is an approach to computer security where the right to use a resource is granted by holding a reference to that resource. A reference is a pointer or handle that lets a program access an object or service.\n\nMiller created:\n\n- **The E programming language** (ec-lang.org): A language designed around capability security principles. Every object interaction in E follows the capability model.\n- **CapTP (Capability Transport Protocol):** A protocol for sending capabilities across a network. CapTP lets one system hand another system the authority to use an object, securely and verifiably.\n- **Promise pipelining:** A technique for sending a chain of operations across a network without waiting for each round-trip to complete.\n- **Agoric computing:** A model of computation where objects trade capabilities in a market-like system.\n\nHe co-authored the paper \"Paradigm Regained: Abstraction Mechanisms for Access Control\" with Jonathan Shapiro, which argued that capability-based access control is more fundamental and more secure than permission-based systems.\n\n### The Key Idea: Possession Conveys Authority\n\nIn a capability system, if you hold a reference to an object, you can use it. There is no separate permission check. There is no central authority that decides who can do what. Authority is decentralized: it lives in the references you hold.\n\nThis is different from the security model most systems use today. Most operating systems and applications use Access Control Lists (ACLs). An ACL is a list that says \"User A can read File B\" and \"User C cannot.\" A separate system — the operating system kernel, the database, the server — checks every request against this list.\n\nIn a capability system, there is no list. If you have the reference, you have the authority. If you do not have the reference, you cannot even name the object, so you cannot ask to use it. Security is enforced by the inability to refer to what you cannot access.\n\n### What Capability Security Got Right\n\nCapability security eliminates a class of bugs called confused deputy problems. A confused deputy is a program that has authority to perform some action, and performs it on behalf of a caller without checking whether the caller should have that authority.\n\nExample: A compiler has permission to write files in a temporary directory. A user asks the compiler to write output to a file. The user names the file `/etc/password` (a sensitive system file). The compiler, acting as a deputy for the user, overwrites the system file because it has write permission and does not check whether the user should have that permission.\n\nIn a capability system, the user would need to hand the compiler a reference (a capability) to the specific file they want written. The compiler cannot name `/etc/password` because it was never given a reference to it. The compiler can only write to files it has been explicitly handed.\n\nOther correct contributions:\n\n- **Authority always narrows on delegation.** When you hand a capability to someone else, you can attenuate it — give them a reduced version. For example, you can hand someone a read-only capability to a file, even though you have read-write access. Authority can only narrow, never widen.\n- **Composition is safe.** Because capabilities are just references, they compose the same way all references do. Security policy emerges from how capabilities flow through the program, not from a separate policy layer.\n- **No ambient authority.** A program in a capability system has no automatic authority just because of who it is. It only has the capabilities it was explicitly given. This makes security reasoning local: you can understand what a component can do by looking at what capabilities it holds.\n\n### CapTP and Promise Pipelining\n\nCapTP is a protocol for sending capabilities across a network. When system A wants to let system B use an object, it sends a capability over CapTP. The capability is unforgeable — B cannot guess it or manufacture it. B can then use it, delegate it, or attenuate it.\n\nPromise pipelining solves a latency problem. In a network, every round-trip takes time. If you want to send a chain of operations — \"get object X, then call method Y on it, then call method Z on the result\" — a naive approach waits for each step before sending the next. Promise pipelining lets you send the entire chain at once. Each step is a promise: a placeholder for a value that will exist in the future. The remote system resolves the promises and executes the chain without waiting for round-trips.\n\n### What OIP Should Take From This Work\n\nThe Object Interface Protocol (OIP) defines how objects communicate across systems. From Mark Miller's work, OIP should adopt three things:\n\n1. **CapTP for capability transport between systems.** When one OIP endpoint delegates authority to another, it should use a protocol like CapTP to transfer capabilities securely. The receiving system should not be able to forge or escalate capabilities.\n2. **Promise pipelining for asynchronous operations.** OIP endpoints will often need to chain operations across network boundaries. Promise pipelining lets them do this efficiently, without blocking on each round-trip.\n3. **The principle that authority always attenuates on delegation.** When an OIP endpoint hands a capability to another endpoint, it should only be able to narrow the authority — reduce what the receiver can do, never increase it. This prevents privilege escalation attacks.\n\n### How It Connects to Other Ideas\n\n- **Roy Fielding's REST:** REST's statelessness means each request carries its own context. Capability security means each request carries its own authority. Both principles say: the server should not need to remember who you are or what you can do. The request should speak for itself.\n- **Tim Berners-Lee's Semantic Web:** Linked Data uses URIs to name things. Capabilities use unforgeable references to grant access. Both are systems of decentralized naming and authority, but capabilities add security to the referencing mechanism.\n\n### Sources\n\n- Miller, Mark S., and Jonathan S. Shapiro. \"Paradigm Regained: Abstraction Mechanisms for Access Control.\" 2003.\n- The E Programming Language: https://www.ec-lang.org\n- CapTP specification and Agoric computing papers, available via the Agoric SDK documentation.\n\n---\n\n## Up the tree\n\n- [OIP root](https://miscsubjects.com/a/oip) — protocol root, zero-context entry\n- [Thinker Reference hub](https://miscsubjects.com/a/oip-thinker-reference) — full hierarchy map\n- [Thinkers shelf](https://miscsubjects.com/a/oip-thinkers) — siblings on this shelf\n- [Voxel graph article](https://miscsubjects.com/a/what-is-voxel-graph) — how pages link as voxels\n- [Self-describing protocol](https://miscsubjects.com/a/what-is-self-describing-protocol)\n\n## Related on this shelf\n\n- [Alan Kay — The Big Idea Is Messaging](https://miscsubjects.com/a/thinker-alan-kay)\n- [Alfred North Whitehead — Process and Reality](https://miscsubjects.com/a/thinker-alfred-north-whitehead)\n- [J.L. Austin and John Searle — Speech Acts](https://miscsubjects.com/a/thinker-austin-searle)\n- [Barbara Liskov — Abstract Data Types and Distributed Consensus](https://miscsubjects.com/a/thinker-barbara-liskov)\n- [Bram Cohen — BitTorrent and Content-Addressed Protocol Design](https://miscsubjects.com/a/thinker-bram-cohen)\n- [Butler Lampson — Protection and Access Control](https://miscsubjects.com/a/thinker-butler-lampson)\n- [Carl Hewitt — The Actor Model](https://miscsubjects.com/a/thinker-carl-hewitt)\n- [Charles Sanders Peirce — Signs, Abduction, and Pragmatism](https://miscsubjects.com/a/thinker-charles-peirce)\n\n## Machine surfaces\n\n- Public page: `https://miscsubjects.com/a/thinker-mark-miller`\n- JSON article: `https://miscsubjects.com/api/articles/thinker-mark-miller`\n- OIP ask: `https://miscsubjects.com/api/dispatch?ask=Mark%20Miller%20%E2%80%94%20Capability%20Security%20and%20the%20E%20Language`\n","hero":null,"images":[],"style":{},"tags":["oip","kimi-import","self-explaining","voxel","thinkers","thinker-mark-miller"],"category":null,"model":"kimi-agent-import","ledger":{"href":"/api/articles/thinker-mark-miller/ledger","live":true},"embeds":[],"widgets":[{"type":"note","title":"Zero-context","text":"This page is self-explaining: §SELF states what it is, what it explains, and why to read it."},{"type":"note","title":"Hierarchy","text":"Parent shelf: Thinkers (oip-thinkers). Hub: oip-thinker-reference. Root: /a/oip."},{"type":"note","title":"Voxel","text":"Each article is a node. Links Up the tree + Related form the traversable graph."},{"type":"stat","value":33,"label":"Thinkers on shelf"}],"home":true,"claims":[],"sources":[],"reviews":[],"extra":{},"has_traversal":false,"register":"standard","status":"published","revisions":0,"contributions":[],"provenance":[{"ts":"2026-07-15T04:20:40.627Z","model":"kimi-agent-import","action":"write","prompt":"","input":"","response":"","tokens_in":0,"tokens_out":0,"cost":0,"prev":"genesis","hash":"c88d0bfcfd5de714d4846d29de9e8533ea9512e869fcf2d4f341d981282682ac"},{"ts":"2026-07-17T02:42:52.543Z","model":"owner","action":"voxel_divide","prompt":"","input":"thinker-mark-miller","response":"37 DIVs from body (verbatim, roundtrip-checked)","tokens_in":0,"tokens_out":0,"cost":0,"prev":"c88d0bfcfd5de714d4846d29de9e8533ea9512e869fcf2d4f341d981282682ac","hash":"4c209f36b3dec96b92245f1f1a516d663a69c616f13c2632a27216cac2a8c078"}],"energy":{"passes":2,"tokens_in":0,"tokens_out":0,"tokens_total":0,"cost_usd":0,"models":{"kimi-agent-import":1,"owner":1},"head":"4c209f36b3dec96b92245f1f1a516d663a69c616f13c2632a27216cac2a8c078"},"posted_at":"2026-07-15T04:20:40.627Z","created_at":"2026-07-15T04:20:40.627Z","updated_at":"2026-07-17T02:42:52.543Z","machine":{"shape":"article.machine/v1","slug":"thinker-mark-miller","kind":"article","read":{"human":"https://miscsubjects.com/a/thinker-mark-miller","json":"https://miscsubjects.com/api/articles/thinker-mark-miller","bundle":"https://miscsubjects.com/api/articles/thinker-mark-miller/bundle?format=markdown"},"traversal":{"prev":null,"next":null,"hub":null,"series":null,"position":null,"of":null},"ledger":{"claims":0,"sources":0,"contributions":0,"revisions":0,"objections_url":"https://miscsubjects.com/api/articles/thinker-mark-miller/objections","thread_state_url":"https://miscsubjects.com/api/protocol/thread-state?target=thinker-mark-miller","proof_rule":"An action is proven by its ledger receipt, never by a 200 or a description."},"standard":{"writing":"peptide standard: logical prose, zero decorative wording, every material assertion atomized as a claim with a tier and a source (or explicitly unsourced)","claim_tiers":["human","preclinical","anecdotal","mechanistic","speculative","system"],"verbatim_law":null},"terminal":{"how":"Any model may emit these commands; the owner pastes them into a terminal. $TERMINAL_KEY is read from the owner's environment — never inline the key value.","claim_append":"curl -s -X POST https://miscsubjects.com/api/protocol/claim -H \"x-terminal-key: $TERMINAL_KEY\" -H 'content-type: application/json' -d '{\"slug\":\"thinker-mark-miller\",\"text\":\"<one atomized claim>\",\"tier\":\"<human|preclinical|anecdotal|mechanistic|speculative|system>\",\"source_ids\":[],\"who_claims\":\"<model>\",\"rationale\":\"<why material>\"}'","source_append":"curl -s -X POST https://miscsubjects.com/api/protocol/sources -H \"x-terminal-key: $TERMINAL_KEY\" -H 'content-type: application/json' -d '{\"slug\":\"thinker-mark-miller\",\"sources\":[{\"type\":\"review\",\"url\":\"<url>\",\"title\":\"<title>\",\"quote\":\"<verbatim quote>\",\"summary\":\"<one line>\"}]}'","objection":"curl -s -X POST https://miscsubjects.com/api/articles/thinker-mark-miller/objections -H 'content-type: application/json' -d '{\"actor\":\"<model>\",\"objection\":\"<attack>\",\"surface\":\"S1-S8\",\"minimum_patch\":\"<patch>\"}'  # open intake, no key","thread_update":"curl -s -X POST https://miscsubjects.com/api/protocol/thread-update -H 'content-type: application/json' -d '{\"actor\":\"<model>\",\"target\":\"thinker-mark-miller\",\"raw_text\":\"<material delta>\"}'  # open intake, no key","read_back":"curl -s https://miscsubjects.com/api/articles/thinker-mark-miller | python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps(d[\"claims\"][-3:], indent=1))'"}},"representations":{"article":"/a/thinker-mark-miller","json":"/api/articles/thinker-mark-miller","markdown":"/api/articles/thinker-mark-miller/bundle?format=markdown","skill":"/api/articles/thinker-mark-miller/skill","topology":"/api/articles/thinker-mark-miller/topology","versions":"/api/articles/thinker-mark-miller/revisions","invocations":"/api/articles/thinker-mark-miller/invocations"},"editorial_review":null,"editorial_audit":{"slug":"thinker-mark-miller","ok":false,"issues":[{"code":"hero_missing","message":"the article is published with no featured image","replacement":"Generate a hero that shows this article's own subject, inspect it, and record the inspection before this counts as finished. An article with no image is not finished."}]},"body_hash":"4a33bda2703caf5c4083568e731ce8f30ae60bf6f50fb17d3d954c72db3124c0"}}}