Scan all C-lists, remove relevant capabilities
– Far too expensive!
• Use indirection
– Each object has entry in a global object table
– Names in capabilities name the entry, not the object
• To revoke, zap the entry in the table
• Can have multiple entries for a single object to allow control of
different sets of rights and/or groups of users for each object
– Example: Amoeba: owner requests server change random number
in server table
• All capabilities for that object now invalid