what does capability-safe mean?