You seem to be unaware of the existence of capability based security. https://en.wikipedia.org/wiki/Capability-based_security