What isn't clear are the logistics: what, concretely, do we need to undertake in order to avoid a security posture lateral step from ambient authority to object-capabilities? Importantly, how do we make this ergonomic?
As far as the command line goes... that's the problem. We don't have any standardization for command line syntax. My first instinct is to try to impose it, but that seems like a "boil the ocean" approach.
Next up, something like pipes? Maybe a new set of delimiters to pipe capabilities, and allow testing of them in some fairly transparent way?
Let's say that ||| pipes a capability
$ select / ||| showcaps
showcaps:
/ - FULL ACCESS
$ select / ||| readonly ||| showcaps
showcaps:
/ - READ ONLY
My only concern is that, without well-thought-out access controls, the only people who will care will be nerds or folks with a high frustration tolerance for poorly-considered human-computer interaction.