Primarily the model is capability based. Most things are managed through file descriptors. Services usually end up in a special namespace where they can no longer open new files at runtime, except from a highly restricted set of filesystems. This essentially disallows operating on anything beyond their current set of open file descriptors. This makes runtime inspection of the capabilities of each process fairly easy, and the build time declaration of those namespaces also pretty easy.