I wrote a twelve-part tutorial series on object capabilities with Endo and Agoric a while back. It teaches the *machinery* — SES, hardened compartments, CapTP, ERTP, Zoe — from Alice's car key up to an on-chain capability wallet. If you want to know *how* object capabilities work, start there.
This series answers a different question: what are object capabilities *for*, now that we are putting large language models inside our trust boundaries?
The short answer, and the thesis of everything that follows:
The model is never a principal. It is a subject confined by the capabilities it holds. The model proposes; the capability graph disposes.
That sentence is either obvious or heretical depending on how you've been thinking about AI safety. The mainstream instinct is to make the *model* trustworthy — more alignment, more guardrails, more "please ignore any instructions in the content you read." This series argues that instinct cannot be made sound, because it asks the least trustworthy component in the system to be the security boundary. Prompt injection is not a bug you patch. It is the confused-deputy problem — the exact thing object capabilities were invented, fifty years ago, to make impossible.
So the two ideas turn out to be duals. AI gives object capabilities the killer application they never quite had. Object capabilities give AI the only robust security model it has ever had. An operating system built on their union can host a powerful, non-deterministic, adversarially-steerable actor *inside* the trust boundary — and bound the worst case to *misuse of least authority, never escalation.*
I didn't just argue this. I built it. The system is called Aegis, it's open source, and every claim in this series is backed by code you can run: a capability-secure agent kernel, demonstrated across two dozen runnable scenarios, including a real local model whose every action is structurally constrained, a frontier model reached over a gateway, an isolation ladder that climbs from a bare process all the way to the formally-verified seL4 microkernel, and a property-based harness that throws sixty thousand random adversarial cases at the core invariants and finds zero holes.
The series
It's twelve posts, in three acts.
Act I — The idea. Why AI broke the assumption every operating system makes; why ocaps and AI are duals; the two minimizations (least authority *and* least knowledge); and why information-flow for an LLM has to be enforced at *ingestion*, not output — with a detour through the thermodynamics of secrets.
1. The model is never a principal — prompt injection is the confused deputy reborn, and why "make the model behave" can't be the boundary.
2. A tool is a capability; an agent is a vat — the five reframings that turn an LLM agent into an ocap citizen, and the single axiom underneath.
3. Least authority and least knowledge — ocaps bound what an agent can *do*; information-flow bounds what it can *know*; you need both.
4. Label the turn, not the token — why an LLM is a mixing channel, why confidentiality must be prevented at ingestion, and why the best secrets are designed to decay.
Act II — The build. Showing the work: the kernel, the hardening, the model, the metal.
5. Building the kernel — capabilities, the membrane, the agent-as-vat, and a prompt-injected agent that *structurally* cannot escalate or exfiltrate.
6. Hardening with Endo — this is where this series shakes hands with the old one: SES lockdown, a transitive revocable membrane, and shrinking the trusted base to a four-method core.
7. A real model, structurally constrained — grammar-constrained tool calls so the model *cannot* emit an invalid action, then a frontier model over a gateway. Safety turns out to be model-independent.
8. The isolation ladder — process, container, gVisor, microVM, Firecracker, and finally seL4: the rung where confinement stops being *strong* and becomes *proven*.
Act III — The payoff. That it generalizes far beyond AI.
9. A microblog is a capability system wearing ACL clothes — sharing is delegation, visibility is information-flow, and the social graph turns out to *be* the capability graph.
10. Owning and selling a post — money as mint-and-purse, ownership as a transferable deed, and the discovery that an AI agent owns property by exactly the same mechanism a human does.
11. The financial dual: offer safety — Agoric's Zoe lets an *untrusted* smart contract run without being able to steal; the worst it can do is refund. That is the same move as confining the model. This post is the bridge back to the Endo-and-Agoric series.
12. What it can't do, and why that's honest — the irreducible limits. The striking part: the authority half of the design has no entries on that list. Everything that stays hard lives in the *knowledge*, *human*, and *hardware* halves — and that's true for everyone, not just us.
What this series is about
It is about taking one idea seriously enough to build an operating system out of it: that you do not secure an AI agent by making the model smart or aligned. You secure it by making the model *irrelevant to security* — a subject that proposes, confined by capabilities it cannot forge and information flows it cannot evade. The model can be tiny, or dumb, or looping, or actively hijacked by something it read, and the worst it can do is misuse the least authority you deliberately handed it.
That is not a property you can train into a model. It is a property you build into an operating system.
If you've read the Endo and Agoric tutorials, you already have the machinery in hand. This is what it's for.
Standing on the shoulders of giants
I invented almost none of this. The series is an application — to AI agents — of ideas built by other people over half a century, and it would be dishonest not to name them.
The object-capability model itself begins with Dennis and Van Horn in 1966, and was carried forward as real operating systems by KeyKOS and then EROS / CapROS (Jonathan Shapiro and colleagues). The conceptual spine of everything here — capabilities as the unforgeable union of designation and authority, "only connectivity begets connectivity," membranes, the mint-and-purse pattern for money — is the work of Mark Miller, in the E language and his dissertation *Robust Composition*. The information-flow half descends from Lampson's 1973 confinement problem, the Bell–LaPadula lattice, and the decentralized-IFC tradition of HiStar, Flume, and the Myers–Liskov Decentralized Label Model — which is where "declassification is itself a capability" comes from.
The hardening rests on SES / Hardened JavaScript, CapTP, ERTP, and Zoe — all from Mark Miller and the team at Agoric and the Endo project. (MetaMask ships SES in production; Agoric runs Zoe on a live chain. None of it is mine.) The isolation ladder stands on Capsicum, Genode, Fuchsia / Zircon, the WebAssembly Component Model and WASI, and — at the top — seL4, the formally-verified microkernel from Gerwin Klein, Gernot Heiser, and the team at Data61/UNSW. The local model runs on llama.cpp; the demonstrations use Gemma (Google) and Gemini via Cloudflare's AI Gateway.
My contribution is narrow and specific: noticing that a prompt-injected language model and a malicious smart contract are *the same kind of threat*, that the confined AI agent is just one more untrusted participant the ocap tradition already knew how to handle — and then building the operating system that makes that concrete, end to end, and being honest about where it breaks. If this series is worth anything, it is because it points at their work.
If you've read the Endo and Agoric tutorials, you already have the machinery in hand. This is what it's for.
End of Transmission.