The Capability is a signed blob used to delegate new permissions to read, write, or author as another identity.

It is used to grant signing permissions to other devices or people.

Each capability is a .

Shape

Contains the following fields

Signer
Delegate – The Account ID of the identity receiving new capabilities
Role
Label
Revoked – Boolean, true if the capability is being revoked
Path
Recursive
Deps – The CIDs of capabilities to depend on. Used to form a chain of capabilities
Signature – Cryptographic proof of this shape from the signer

Chaining

A capability might be granting permissions to another account, which might require a chain of capabilities.