Comment by caf

There is a model, it's just not particularly well publicised: a file descriptor is a capability.

That's it.