On Tue, Mar 18, 2003, Zooko wrote:

For example, suppose you want to control the ability to listen on sockets for network traffic. If there is a reference (e.g., to an object) that represents the privilege of listening on sockets, then you can give such a reference to one object, allowing that object it to listen on sockets, while withholding it from another object, thus preventing that one from listening on sockets.

Doesn't that only work if the second object never gains a reference to the first object?