in code implementation. These structural properties facilitate the analysis of some security properties of an object-capability program or operating system. Some of these in particular, information flow properties can be analyzed at the level of object references and connectivity, independent of any knowledge or analysis of the code that determines the behavior of the objects. As a consequence, these security properties can be established and maintained in the presence of new objects that contain unknown and possibly malicious code. These structural properties stem from the two rules governing access to existing objects: 1) An object A can send a message to B only if object A holds a reference to B. 2) An object A can obtain a reference to C only if object A receives a message containing a reference to C. As a consequence of these two rules, an object can obtain a reference to another object only through a preexisting chain of references. In short, "Only connectivity begets connectivity." Glossary of related terms object-capability system A computational system that implements principles described in this article. object An object has local state and behavior. An object in this sense is both a subject and an object in the sense used in the access control literature. reference An unforgeable communications channel (protected pointer, opaque address) that unambiguously designates a single object, and provides permission to send messages to that object. message What is sent on a reference. Depending on the system, messages may or may not themselves be first-class objects. request An operation in which a message is sent on a reference. When the message is received, the receiver will have access to any references included in the message. attenuation A common design pattern in object-capability systems: given one reference of an object, create another reference for a proxy object with certain security restrictions, such as only permitting read-only access or allowing revocation. The proxy object performs security checks on messages that it receives and passes on any that are allowed. Deep attenuation refers to the case where the same attenuation is applied transitively to any objects obtained via the original attenuated object, typically by use of a "membrane". Implementations Almost all historical systems that have been described as "capability systems" can be modeled as object-capability systems. (Note, however, that some uses of the term "capability" are not consistent with the model, such as POSIX "capabilities".) KeyKOS, EROS, Integrity