A &quot;capability&quot; is, abstractly, a <i>thing</i>. I can send you a message, in that message I can include a capability to access some resource. When you receive the message, you can follow that capability and you&#x27;ll have access to the resource. Your <i>identity</i> is never checked -- your authority to access the resource is based on your possessing the capability, regardless of who you might be.<p>RBAC -- role-based access control -- is identity-based. Certain identities have certain roles. Certain roles are allowed to perform certain actions on certain resources. When you access a document in an RBAC system, your identity is determined, then the roles associated with that identity are determined, and then you get access based on whether you have the role.<p>Capability-based security and identity-based security are mutually exclusive approaches (although you can build a system that does both, for defense in depth).<p>(See also my very long top-level comment for more background on capabilities and how they are used.)