Google Caja - A source-to-source translator for securing Javascript-based web content

I've actually been mulling over the possibility of combining the capability security model with a continuation-based web application framework, and think a Lisp with continuations (like Scheme or Arc) might be the easiest substrate from which to start.

It seems like a natural fit: your current capability grants would be closed over in any lexical scope, which means that a continuation would also encapsulate a capability set. Resuming the continuation would implicitly restore the security context active when it was captured.

A capabilities system in Scheme was done in the 90s, though AFAIK it is now dead. Still the paper describing it is worth reading and may give you some inspiration: http://fare.tunes.org/tmp/emergent/secureos.htm