For discussion of Caja, an object capabilities based security model for DHTML applications.

Wikipedia has a good primer on object capabilities. 

The Caja project's code is hosted at http://code.google.com/p/google-caja/

http://www.eros-os.org/mailman/listinfo/cap-talk is a better place than this list for general discussions of object capabilities.