jar8: [Message fragments originally sent just to markm. I'm re-sending to e-lang at markm's request. Edited from the original.
 jar8: My feeling is that it's possible that he's right - you may need both capabilities
     tyler: Don't we also already have a standard design pattern for this problem? Give each user a unique revokeable forwarder.
 jar8: The fact that ACL's give the appearance of security is good voodoo. The appearance of security is as important as security itself.
     tyler: Explaining the capability design should be easy. I did it in two short sentences.