OCAP Bounded Authority: Edera's Managed Approach to Object Capabilities
Summary
OCAP Bounded Authority explains a security model where access is granted as narrowly scoped capabilities rather than broad credentials. Edera describes object-capability security, bounded authorities for AI agents and Kubernetes workloads, and a capability broker (capcurl and capsudo) that enforces explicit authority. The article argues for separating identity from authority and outlines a four-layer model (Identity, Isolation, Capabilities, Management) to reduce risk when workloads are compromised.