Direct answer
Capability Controls, in this current-law summary, is limited to the following inspected scope. Sender-constrained access tokens and restriction to minimum required privileges, audience, resources, and actions. Enforcing approved authorizations and limiting privileges to required functions. The answer carries the source boundaries forward and does not infer authority from a neighboring topic.
Current Law summary
Name the jurisdiction, instrument, article, effective context, and material scope before summarizing a rule.
Current-law pages are informational, can become stale, and do not replace qualified legal advice.
Applied scope: Sender-constrained access tokens and restriction to minimum required privileges, audience, resources, and actions. Enforcing approved authorizations and limiting privileges to required functions.
Definition and operating context
The canonical concept owner is maha-policy. This route may apply governance; it cannot redefine or inherit the authority of its canonical owner.
This property may publish current-law summaries, policy evidence, Maha proposals labelled as proposals. It must not publish legal advice or proposal presented as enacted law.
Evidence and exact locators
Best Current Practice for OAuth 2.0 Security — Sections 2.2 and 2.3. Establishes: Sender-constrained access tokens and restriction to minimum required privileges, audience, resources, and actions.
Security and Privacy Controls for Information Systems and Organizations — AC-3 Access Enforcement and AC-6 Least Privilege. Establishes: Enforcing approved authorizations and limiting privileges to required functions.
What the evidence does not establish
OAuth controls do not define every agent capability or prevent misuse by an authorized holder.
Control selection and implementation do not themselves establish effectiveness or legal compliance.
This route must not claim legal advice.
This route must not claim proposal presented as enacted law.
Related definitions and applications
same-topic-application: https://policy.mahastrategies.com/policy/capability-controls/definition
graphEdges: https://policy.mahastrategies.com/policy/tool-governance/definition
same-topic-application: https://policy.mahastrategies.com/policy/capability-controls/uncertainty
same-topic-application: https://policy.mahastrategies.com/policy/capability-controls/mechanisms
property-home: https://policy.mahastrategies.com/
same-topic-application: https://policy.mahastrategies.com/policy/capability-controls/comparison
same-topic-application: https://policy.mahastrategies.com/policy/capability-controls/evidence
Questions this page can answer
What does Capability Controls mean in this bounded context?
Capability Controls, in this current-law summary, is limited to the following inspected scope. Sender-constrained access tokens and restriction to minimum required privileges, audience, resources, and actions. Enforcing approved authorizations and limiting privileges to required functions. The answer carries the source boundaries forward and does not infer authority from a neighboring topic.
Which inspected sources support this current law answer?
Best Current Practice for OAuth 2.0 Security (RFC 9700 / BCP 240, January 2025), at Sections 2.2 and 2.3, supports sender-constrained access tokens and restriction to minimum required privileges, audience, resources, and actions. Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5.1.1), at AC-3 Access Enforcement and AC-6 Least Privilege, supports enforcing approved authorizations and limiting privileges to required functions.
What does the evidence not establish?
OAuth controls do not define every agent capability or prevent misuse by an authorized holder. Control selection and implementation do not themselves establish effectiveness or legal compliance. Property boundary: This route may apply governance; it cannot redefine or inherit the authority of its canonical owner.
Which definition or canonical owner must be read first?
This page is the local maha-policy definition for its topic. Related applications may depend on it but may not silently redefine it.
What source, policy, implementation, or release change would require revision?
Re-evaluate this page when a cited source, locator, governing instrument, local implementation, or canonical definition changes. Publication also requires a matching exact-revision review and active canonical release.