Capability-based security model for Cloud IAM

I'm the author here. If you have any questions on secure access control vs ACL, I'm happy to share my thoughts.