In a capability-based access control model, which statement describes a capability?

• A. A token or reference granting specific access to an object.
• B. A record of roles assigned to a user.
• C. A physical badge used for entry.
• D. A policy that denies all access by default.

Answer: (A)

Capability-based access control relies on presenting a capability—a token or reference that encodes both the object and the operations allowed on it. The bearer’s possession of this credential grants exactly the specified access to that object, and the system verifies the token before permitting the action. This makes the ability to access resources tied to a transferable credential rather than to a fixed user attribute or role. It’s distinct from a user’s role list or attributes, from a physical badge used for entry, or from a blanket deny-by-default policy, which are not how capabilities function.