Any program can protect its invariants by hiding its own data and capabilities.
The only way to exercise power over something is to have a reference to the object that provides that power, like a file system object, or even a highly limited,
file system object. We call a reference to a powerful object a
The only way to get a capability is to be given one, for example by receiving one as an argument of a constructor or method.