| Command/OCap              | Descriptive/ID/Judgement    | Hybrid                               |
|---------------------------+-----------------------------+--------------------------------------|
| (Language/OS) OCaps       | ACLs                        | Certificate OCaps                    |
| Do this thing.            | Here's what happened!       | Fact checking both ends of the story |
| CapTP                     | Verifiable Creds            | zcap-ld                              |
| Read + Eval               | Print                       | Replay command history               |
| Possession                | Identity                    | Proof of possession (?)              |
| Car key                   | E-car fingprint scan        | Car key sign-out sheet               |
| Don't separate Desig+Auth | Separate resources, users   | Invoking cert caps vs reading them   |
| MUD/IF input prompt       | MUD / IF event descriptions |                                      |
| AP C2S (mostly)           | AP S2S (mostly)             | AP + cert chains?                    |
| Authorization             | Authentication              | Horton                               |
| Program flow              | Authoring program           | ?                                    |
| Source code               | Database                    | ?                                    |