Capabilities are explicit, fine-grained, and enforced by the compiler — not a runtime sandbox