In addition to capabilities, which implemented the principle of least privilege (and keep untrusted code sandboxed by default) there is a need for binary verifi

In addition to capabilities, which implemented the principle of least privilege (and keep untrusted code sandboxed by default) there is a need for binary verification. A check that a whatever is downloaded cannot exceed it's capabilities. Part of the challenge is that hardware tried and has failed to be trustworthy in implementing security boundaries. The failure appears to be because a misalignment of incentives. I think the premise of a capability based operating system can help a lot, but for something to work in the long term the incentives need to aligned.