I would hate to argue over semantics. But in addition to the keys being checked automatically at run time, the type system ensured that, unless the capability had been revoked, illegal requests would not type-check at compile time. Which I think is pretty close to unutterable.

The keys were there to stop an attacker, the type-checker helps the good guys stay in line.

> the type system ensured that, unless the capability had been revoked, illegal requests would not type-check at compile time

I don't think I can imagine what you mean here. How would my compilation success depend on whether an Admin has given me the right to read or write to a certain path?