Enforcing a security policy means controlling the rights users can acquire to data. In a capability machine, a user’s rights are defined by the capabilities he (or a process acting on his behalf) can obtain and the access rights conferred by those capabilities.