In a capability-based access control model, which statement describes a capability?

• A. A record of roles assigned to a user.
• B. A physical badge used for entry.
• C. A token or reference granting specific access to an object.
• D. A policy that denies all access by default.

Answer: (C)

In capability-based access control, access is granted by possessing a capability—a token or reference that encodes the specific rights to an object. This capability explicitly states what operations are allowed (for example, read or write) on that particular object and may include constraints like time limits or scope. Because possession of the capability itself grants access, it can be carried and presented to access the resource without checking a central policy each time.

The other ideas don’t describe a capability: a record of roles is how RBAC assigns access, not a portable right token; a physical badge is a physical access control method, not a digital capability; a policy that denies all access by default reflects a default-deny rule, not a capability issued for a specific object and set of operations.