Also seems like Magenta doesn’t have users and groups as a first class construct. It looks like there are primitives to create them in user space, but the kernel only has one construct (Jobs) by which security is administered, rather than the many different security paradigms of a nix system (i.e. a process can have access based on what user it’s running as, uid not, SecComp control, etc). This makes security much easier to manage at the kernel level as all security granted to processes is explicitly granted rather than inferred, as is often the case in nix.

Honestly, I think the multi-user assumptions that *nix started with are largely irrelevant now. Most people don’t have multi-user needs on their devices (you can’t even do it on iOS), and even servers are moving towards single-user constructs with containers, etc. I think the an operating system built around a multi-user model will be viewed as the edge case in the coming decades rather than the norm.

Aside from the microkernel, doesn't Android already do capability based security?