To revoke them, the usual pattern is to never hand out the original capability, you hand out a wrapper that you can disable. E.g. in Javascript:<p><pre><code>    let [revoke, revocable] = makeRevocable(cap);
    share(revocable); &#x2F;&#x2F; share can call revocable(), which forwards to cap() unless revoked
    setTimeout(1000, revoke); &#x2F;&#x2F; for auto-expiring, just for example
</code></pre>
See section 4.3 in <a href="http:&#x2F;&#x2F;www.erights.org&#x2F;talks&#x2F;asian03&#x2F;index.html" rel="nofollow">http:&#x2F;&#x2F;www.erights.org&#x2F;talks&#x2F;asian03&#x2F;index.html</a><p>A capability system can help you batch up those round trips you mention, btw: <a href="https:&#x2F;&#x2F;capnproto.org&#x2F;rpc.html" rel="nofollow">https:&#x2F;&#x2F;capnproto.org&#x2F;rpc.html</a>