1. A method of controlling access to computational features, the method including: preparing a first computational resource for execution by an execution system that has been provided primary descriptors each associated with a respective identity value and each associated with a respective feature indicator; accessing a secondary descriptor containing a first identity value, the first identity value associated with a first primary descriptor of the primary descriptors, the secondary descriptor being cryptographically assigned to the first computational resource; accepting an instruction from the first computational resource to execute a second computational resource; cryptographically assigning at least one instance of the secondary descriptor containing the first identity value to the second computational resource, including combining the second computational resource with the instance of the secondary descriptor, and cryptographically signing the combination; granting the second computational resource access to a computational feature of the execution system based on the feature indicator associated with the instance of the secondary descriptor; and verifying, during an execution of the second computational resource, that the instance of the secondary descriptor is cryptographically assigned to the second computational resource, to determine that the second computational resource is authorized to access only the computational features enabled according to the feature indicator associated with the first computational resource.