The object-capability model is a computer security model. A capability describes a transferable right to perform one (or more) operations on a given object. It can be obtained by the following combination: An unforgeable reference (in the sense of object references or protected pointers) that can be sent in messages. A message that specifies the operation to be performed. The security model relies on not being able to forge references. Objects can interact only by sending messages on references. A reference can be obtained by: Initial conditions: In the initial state of the computational world being described, object A may already have a reference to object B. Parenthood: If A creates B, at that moment A obtains the only reference to the newly created B. Endowment: If A creates B, B is born with that subset of A's references with which A chose to endow it. Introduction: If A has references to both B and C, A can send to B a message containing a reference to C. B can retain that reference for subsequent use. In the object-capability model, all computation is performed following the above rules. Advantages that motivate object-oriented programming, such as encapsulation or information hiding, modularity, and separation of concerns, correspond to security goals such as least privilege and privilege separation in capability-based programming. The object-capability model was first proposed by Jack Dennis and Earl C. Van Horn in 1966. Loopholes in object-oriented programming languages Some object-based programming languages (e.g. JavaScript, Java, and C#) provide ways to access resources in other ways than according to the rules above including the following: Direct assignment to the instance variables of an object in Java and C#. Direct reflective inspection of the meta-data of an object in Java and C#. The pervasive ability to import primitive modules, e.g. java.io.File that enable external effects. Such use of undeniable authority violates the conditions of the object-capability model. Caja and Joe-E are variants of JavaScript and Java, respectively, that impose restrictions to eliminate these loopholes. Advantages of object capabilities Computer scientist E. Dean Tribble stated that in smart contracts, identity-based access control did not support well dynamically changing permissions, compared to the object-capability model. He analogized the ocap model with giving a valet the key to one's car, without handing over the right to car ownership. The structural properties of object capability systems favor modularity in code design and ensure reliable encapsulation