Formal Models of Capability-Based Protection Systems | Synapse