A capability names the owner key, writer key and label, carries the block token and the symmetric key, and comes in mirror, read and write grades (write adds the write key); whoever holds it can use it.

It is the thing that is shared, linked and stored everywhere else in the series.

What exactly do you hand over? A capability. A small card that says where a thing is, and how to open it.

Where: the owner's public key, the writer key whose pointer to follow, and the label in the bag.

How: a token the server wants before it releases the blob. And the symmetric key that decrypts it.

Three grades. A mirror capability fetches the ciphertext. A read capability opens it. A write capability adds the write key.

A capability needs no account and no permission list. Whoever holds the card can use it.

Check yourself. What does a write capability have that a read capability does not? What does a mirror capability let you do?