Skip to content

Capability-based addressing

In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security.

Version
v1 · 2026-09-28 · History
Domain-specific #
8329
Domain group
Applied Sciences & Engineering
Origin domain
Computer Science & Software Engineering
Subdomains
Computer Architecture, Capability Based Security → Computer Science & Software Engineering

Core Idea

Capability-based addressing is treated here as the recurring computer_science_and_information identity summarized by this source-grounded definition: In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security.

In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. Under a capability-based addressing scheme, pointers are replaced by protected objects (named capabilities) which specify both a location in memory, along with access rights which define the set of operations which can be carried out on the memory location. Capabilities can only be created or modified through the use of privileged instructions which may be executed only by either the kernel or some other privileged process authorised to do so.

Thus, a kernel can limit application code and other subsystems access to the minimum necessary portions of memory (and disable write access where appropriate), without the need to use separate address spaces and therefore require a context switch when an access occurs. Extend memory with an additional bit, writable only in supervisor mode, that indicates that a particular location is a capability. This is a generalization of the use of tag bits to protect segment descriptors in the Burroughs Large Systems, and it was used to protect capabilities in the IBM System/38.

For Capability-based addressing, the abstraction is narrower than the article's general subject matter: a positive case must preserve In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. Retaining only the name, a familiar example, or a downstream effect is insufficient. The specialist roles and tests remain anchored in computer_science_and_information, which is why this identity is domain-specific rather than prime.

How would you explain it like I'm…

Memory Tickets

In some computers, a program can't just point at any spot in the computer's memory. Instead it has to hold a special ticket that says which spot it may use and what it may do there, like 'you may look but not change.' Only the computer's boss part can make or change tickets, so a program can't make a fake one.

Tokens Instead of Addresses

A computer's memory is like a huge set of numbered boxes. Normally a program uses a plain address, called a pointer, to reach a box. With capability-based addressing, a program must instead use a protected token called a capability, which says both which place in memory it may reach and what it is allowed to do there, such as read or write. Only the most trusted part of the system, the kernel, can create or change these tokens. This way each program can reach only the memory it truly needs, and the computer does not have to switch between separate memory spaces to keep programs apart.

Pointers That Carry Permissions

Capability-based addressing is a way for computers to control which parts of memory a program can use. Ordinary pointers are replaced by capabilities: protected objects that hold both a memory location and a set of access rights, like read-only or read-write. Capabilities can be created or modified only by privileged instructions that the kernel, or another authorized privileged process, may run, so programs cannot forge them. This lets the kernel limit each program to the minimum memory it needs without giving each program its own separate address space, which would require costly context switches on access. One hardware trick is to add an extra tag bit to memory, writable only in supervisor mode, that marks which words are capabilities.

 

Capability-based addressing is a memory-access scheme that implements capability-based security efficiently in hardware or low-level system software. Instead of raw pointers, code holds capabilities: protected references that combine a memory location with access rights specifying which operations are permitted on it. The integrity of the scheme rests on the rule that capabilities can be created or altered only by privileged instructions available to the kernel or another authorized privileged process, so user code cannot fabricate or amplify them. Because protection travels with the reference itself, the kernel can confine applications and subsystems to the minimum necessary memory, and can withhold write access, without isolating them in separate address spaces and paying for a context switch on each cross-domain access. A common implementation extends each memory word with a tag bit, writable only in supervisor mode, that marks the word as a capability. That technique generalizes the tag bits used to protect segment descriptors in the Burroughs Large Systems and was used to protect capabilities in the IBM System/38. A system counts as using this scheme only if memory access is actually mediated by such unforgeable location-plus-rights references, not merely if it uses the vocabulary of capabilities.

Structural Signature

Sig role-phrases:

  • Defining carrier — Capabilities can only be created or modified through the use of privileged instructions which may be executed only by either the kernel or some other privileged process authorised to do so.
  • Constitutive relation — Require capabilities to be stored in a particular area of memory that cannot be written to by the process that will use them.
  • Operating condition — Both types of pointer could only be manipulated using privileged instructions, and differed by whether object authorizations (i.e. access rights) were encoded in the contents of the pointer.
  • Recognition evidence — Authorized pointers were irrevocable by design - if the object's authorizations were altered, it would not alter the encoded authorizations in any authorized pointers which already existed.
  • Admissible variation — Early versions of the OS/400 operating system for the AS/400 also supported authorized pointers, and by extension capability-based addressing.
  • Characteristic consequence — In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security.
  • Failure boundary — Under a capability-based addressing scheme, pointers are replaced by protected objects (named capabilities) which specify both a location in memory, along with access rights which define the set of operations which can be carried out on the memory location.

What It Is Not

  • Not the whole field of computer_science_and_information. The node requires the specific identity stated by In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security.
  • Not an over-broad reading. Unauthorized pointers did not encode object authorizations, and required the operating system to check the object's authorization separately to determine if access to the object was allowed.
  • Not an over-broad reading. Authorized pointers encoded object authorizations, meaning that possession of the pointer implied access, and the operating system was not required to verify authorization separately.
  • Not an over-broad reading. Authorized pointers were irrevocable by design - if the object's authorizations were altered, it would not alter the encoded authorizations in any authorized pointers which already existed.
  • Not automatically Memory address. Retrieval proximity does not establish equivalence; the two identities must be compared by carrier, operation, and failure boundary.

Scope of Application

Capability-based addressing applies literally inside computer_science_and_information wherever the source-defined carrier and relation can be established. Its documented habitats include:

  • Practical implementations. This is a generalization of the use of tag bits to protect segment descriptors in the Burroughs Large Systems, and it was used to protect capabilities in the IBM System/38.
  • Documented setting. In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security.
  • Documented setting. Thus, a kernel can limit application code and other subsystems access to the minimum necessary portions of memory (and disable write access where appropriate), without the need to use separate address spaces and therefore require a context switch when an access occurs.
  • Practical implementations. Require capabilities to be stored in a particular area of memory that cannot be written to by the process that will use them.
  • Practical implementations. For example, the Plessey System 250 required that all capabilities be stored in capability-list segments.
  • Practical implementations. Extend memory with an additional bit, writable only in supervisor mode, that indicates that a particular location is a capability.

Outside computer_science_and_information, the name should be retained only when these same operational conditions survive; otherwise the comparison belongs to the broader parent Classification or should be marked as analogy.

Clarity

A clear use of Capability-based addressing names the carrier, the operative relation, and the conditions under which the source treats the identity as present. The minimal definition is In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. The strongest recognition evidence in the frozen account is: Authorized pointers were irrevocable by design - if the object's authorizations were altered, it would not alter the encoded authorizations in any authorized pointers which already existed. A report should distinguish that evidence from a proxy, consequence, or common implementation. It should also state the qualification Unauthorized pointers did not encode object authorizations, and required the operating system to check the object's authorization separately to determine if access to the object was allowed. so that a reader can reproduce the classification rather than infer it from topical resemblance.

Manages Complexity

Capability-based addressing compresses multiple computer_science_and_information details into a stable diagnostic relation. The source shows both the central mechanism—require capabilities to be stored in a particular area of memory that cannot be written to by the process that will use them.—and the practical consequence—in computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. This compression makes cases comparable while leaving parameters, conventions, exceptions, and evidential quality explicit. It is lossy by design: local history and implementation details may be omitted only when they do not alter the defining relation.

Abstract Reasoning

  1. Type the carrier. Identify the computer_science_and_information entities to which the claim applies.
  2. State the relation. Use the source-grounded identity: In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security.
  3. Check operation and conditions. Both types of pointer could only be manipulated using privileged instructions, and differed by whether object authorizations (i.e. access rights) were encoded in the contents of the pointer.
  4. Demand recognition evidence. Authorized pointers were irrevocable by design - if the object's authorizations were altered, it would not alter the encoded authorizations in any authorized pointers which already existed.
  5. Test variation. Change an implementation or setting while preserving early versions of the OS/400 operating system for the AS/400 also supported authorized pointers, and by extension capability-based addressing.
  6. Run the collapse test. Remove the defining operation; if the label still seems equally apt, only a topic or correlate was retained.
  7. Reduce cautiously. When the specialist conditions cannot be carried, route the residual comparison to Classification.

Knowledge Transfer

Within the home domain. Knowledge about Capability-based addressing transfers literally when a new case preserves the same carrier type, relation, and recognition test. This is a generalization of the use of tag bits to protect segment descriptors in the Burroughs Large Systems, and it was used to protect capabilities in the IBM System/38. In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security.

Beyond the home domain. No canonical parent is asserted for Capability-based addressing. An outside case receives the specialist name only when the same typed roles and rejection conditions can be filled literally; otherwise the comparison remains an analogy pending later graph densification.

Examples

Canonical

For example, the Plessey System 250 required that all capabilities be stored in capability-list segments. This case is canonical because it supplies a concrete carrier and lets the defining relation be checked rather than merely named.

Mapped back: carrier → the entities in the documented case; operation → In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security; recognition evidence → Authorized pointers were irrevocable by design - if the object's authorizations were altered, it would not alter the encoded authorizations in any authorized pointers which already existed

Applied / In Practice

Require capabilities to be stored in a particular area of memory that cannot be written to by the process that will use them. The applied case shows how the identity is used under a second setting or qualification while keeping the same operative relation.

Mapped back: changed setting → Practical implementations; invariant → In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security; boundary → the case exits the class when unauthorized pointers did not encode object authorizations, and required the operating system to check the object's authorization separately to determine if access to the object was allowed

Structural Tensions

T1 — Stable identity versus admissible variation. Unauthorized pointers did not encode object authorizations, and required the operating system to check the object's authorization separately to determine if access to the object was allowed. The tension matters because emphasizing only one side either dissolves the identity or overstates what the evidence and domain conventions warrant.

Diagnostic: Which changes preserve the defining relation, and which replace it?

T2 — Recognition versus proxy. Authorized pointers encoded object authorizations, meaning that possession of the pointer implied access, and the operating system was not required to verify authorization separately. The tension matters because emphasizing only one side either dissolves the identity or overstates what the evidence and domain conventions warrant.

Diagnostic: Does the cited evidence establish the identity or only a correlated sign?

T3 — Definition versus implementation. Authorized pointers were irrevocable by design - if the object's authorizations were altered, it would not alter the encoded authorizations in any authorized pointers which already existed. The tension matters because emphasizing only one side either dissolves the identity or overstates what the evidence and domain conventions warrant.

Diagnostic: Is the observed implementation constitutive, optional, or merely common?

T4 — Scope versus overextension. However, authorized pointers were removed in the V1R3 release of OS/400 as their irrevocable nature became seen as a security liability. The tension matters because emphasizing only one side either dissolves the identity or overstates what the evidence and domain conventions warrant.

Diagnostic: Can every claimed application fill the same typed roles without metaphor?

T5 — Transfer versus domain accent. Capabilities can only be created or modified through the use of privileged instructions which may be executed only by either the kernel or some other privileged process authorised to do so. The tension matters because emphasizing only one side either dissolves the identity or overstates what the evidence and domain conventions warrant.

Diagnostic: Does the receiving case instantiate Capability-based addressing literally, co-instantiate Classification, or only resemble it?

T6 — Autonomy versus reduction. Require capabilities to be stored in a particular area of memory that cannot be written to by the process that will use them. The tension matters because emphasizing only one side either dissolves the identity or overstates what the evidence and domain conventions warrant.

Diagnostic: What does Capability-based addressing distinguish that the broader parent Classification leaves together?

Structural–Framed Character

Capability-based addressing is structural-leaning. Its structural side is the repeatable organization summarized by In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. Its framed side is the computer_science_and_information vocabulary that fixes the carrier, evidence, exceptions, and admissible transformations.

Evaluative weight: the identity can be stated descriptively even when applications carry practical stakes. Human-practice dependence: the source-grounded carrier determines whether the relation exists independently or is constituted by a practice. Institutional origin: disciplinary conventions stabilize the name and test. Vocabulary portability: Both types of pointer could only be manipulated using privileged instructions, and differed by whether object authorizations (i.e. access rights) were encoded in the contents of the pointer. Import versus recognition: literal transfer requires the same mechanism; shape alone is analogy.

Its portable skeleton is Classification. Its character: a recurring specialist identity whose thin organization can be abstracted, while its operational meaning remains domain-bound.

Structural Core vs. Domain Accent

What is skeletal. In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. The stable skeleton is the typed relation expressed in that definition and the entry's recognition and collapse tests. The source identifies these operative conditions: Capabilities can only be created or modified through the use of privileged instructions which may be executed only by either the kernel or some other privileged process authorised to do so. Require capabilities to be stored in a particular area of memory that cannot be written to by the process that will use them. It further constrains recognition and variation through: Both types of pointer could only be manipulated using privileged instructions, and differed by whether object authorizations (i.e. access rights) were encoded in the contents of the pointer. Authorized pointers were irrevocable by design - if the object's authorizations were altered, it would not alter the encoded authorizations in any authorized pointers which already existed.

What is domain-bound. computer science and information supplies the operative entities, technical vocabulary, warrants, and exceptions that make Capability-based addressing literal. Its documented scope includes the condition that This is a generalization of the use of tag bits to protect segment descriptors in the Burroughs Large Systems, and it was used to protect capabilities in the IBM System/38. Another bounded application condition is that In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. These are not decorative examples; they determine which carrier and evidence can fill the abstraction's roles.

Why no parent is asserted. Removing those specialist details does not currently yield one live catalog node that is a necessary genus for every instance. The entry is therefore approved as unparented rather than attached by topical resemblance. Its collapse evidence remains specific—Early versions of the OS/400 operating system for the AS/400 also supported authorized pointers, and by extension capability-based addressing.—and future graph densification may discover a defensible relation only if it preserves that boundary.

  • Approved unparented node. No current live node supplies a defensible necessary genus or structural prerequisite for Capability-based addressing. The reviewed identity is: In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security. The accelerated suggestion was declined because topical or lexical similarity does not establish hierarchy; the node is admitted without a parent pending later graph densification.
  • Related reasoning operations. Evidence, representation, comparison, classification, transformation, or evaluation may participate in particular cases, but participation does not make any one of them a necessary parent of every instance.

Neighborhood in Abstraction Space

Capability-based addressing sits in a moderately populated region (45th percentile for distinctiveness): it has near-neighbors but no dense thicket of look-alikes.

Family — Unclustered & Miscellaneous (2551 abstractions)

Nearest neighbors

Computed from structural-signature embeddings · 2026-10-08

Not to Be Confused With

  • Classification. The parent omits the specialist differentia. Tell: Can the case establish In computer science, capability-based addressing is a scheme used by some computers to control access to memory as an efficient implementation of capability-based security?
  • Memory address. Use a fixed-width value within a declared address space to identify an addressable storage unit, with architecture and translation rules determining which physical location a load or store reaches. Tell: Which entry's carrier, operation, and failure condition are satisfied?
  • Virtual memory. Give each process a protected logical address space by translating virtual addresses to physical storage and managing residency, protection, sharing, and replacement independently of the program's apparent contiguous memory. Tell: Which entry's carrier, operation, and failure condition are satisfied?
  • Random-Access Machine. Analyze algorithms on an abstract sequential computer with numbered registers and indirect addressing, making instruction set, word size, and operation-cost assumptions explicit. Tell: Which entry's carrier, operation, and failure condition are satisfied?
  • A measurement, proxy, or consequence. Those may provide evidence without being the identity. Tell: Would Capability-based addressing remain present if the detector or downstream effect changed?
  • A metaphorical analogue. A similar shape outside computer_science_and_information lacks the specialist mechanism. Tell: Do the native roles transfer literally, or only the parent Classification?

References

  • Frozen Wikipedia discovery revision: https://en.wikipedia.org/wiki/Capability-based_addressing (revision 1364671971).
  • Preserved source candidate: https://homes.cs.washington.edu/~levy/capabook/Chapter1.pdf
  • Preserved source candidate: https://homes.cs.washington.edu/~levy/capabook/Chapter8.pdf
  • Preserved source candidate: https://books.google.com/books?id=5DoPAAAACAAJ
  • Preserved source candidate: https://ieeexplore.ieee.org/document/9138994/
  • Preserved source candidate: https://www.arm.com/architecture/cpu/morello
  • Preserved source candidate: http://www.cs.washington.edu/homes/levy/capabook/index.html
  • Preserved source candidate: http://csrc.nist.gov/publications/history/lind76.pdf
  • Preserved source candidate: http://doi.acm.org/10.1145/800053.801932

The frozen Wikipedia revision is discovery provenance. The retained source set was reviewed for identity, formal or operational relation, and scope. The encyclopedia's structural synthesis is bounded to those claims; a thin authority surface is recorded as a nonblocking source-strengthening repair rather than concealed.