Replacing ambient Linux privileges and POSIX root superusers with unforgeable mathematical capability tokens for every IPC call, memory page, and interrupt line.
In a capability-based microkernel, access rights are stored in protected kernel memory, outside the address space of any application. An application refers to objects through opaque capability slots. Even if an attacker achieves arbitrary code execution within a network stack, they cannot manufacture rights to steering actuators.
When a parent component spawns a worker thread, it creates a derivative capability with reduced permissions (e.g. read-only instead of read-write). When the worker terminates or misbehaves, calling revoke on the root capability instantly invalidates all descendants across the vehicle system.