Sealing

Why it matters

Sealing can protect object representations, entry capabilities and cross-domain control flow from direct manipulation.

In brief

Sealing turns a capability into a protected, opaque form associated with a type. Ordinary code cannot use a sealed capability for memory access until an authorised mechanism unseals or invokes it according to the architecture.

Key considerations

1. Encapsulate

Keep implementation authority inside a protected object or service boundary.

2. Type

Use controlled sealing types so only intended code can create or interpret the sealed form.

3. Invoke

Design entry and return paths that validate arguments and preserve least authority.

Evidence and caveats

Sealing is a low-level mechanism, not a complete object or compartment system. Security depends on type allocation, entry code and delegated capabilities.

Use the exact architecture and software specification implemented by the target. Separate architectural guarantees from system-level outcomes.

Primary routes

• University of Cambridge CHERI