capability bounds

Concept

In capability-based architectures such as CHERI, capability bounds are the metadata fields within a capability that encode an authorized address range, constraining the memory locations a capability may dereference and serving as the foundation for spatial memory safety and fine-grained delegation.

First seen 6/21/2026

Last seen 6/21/2026

Evidence 1 chunks

Wiki v1

WIKI

Overview

Capability bounds are the address-range metadata fields embedded inside a capability pointer that define the region of memory the capability authorizes its holder to access. They are one of the core metadata components of capability-based protection systems, alongside permissions, an object type, and an out-of-band validity tag, and are the primary mechanism through which CHERI and related architectures enforce fine-grained spatial memory safety.

Role in CHERI Capabilities

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

2 connections

CHERI ← uses 100% 1e

CHERI capabilities include bounds metadata controlling memory access.

capability pointer ← extends 90% 1e

Capability pointers include bounds as part of their metadata.

LINKED ENTITIES

2 links

CHERI USES Extracted graph relationship

capability pointer EXTENDS Extracted graph relationship

CITATIONS

6 sources

6 citations — click to expand

[1] Capability bounds encode a base and a top address using a compression algorithm relative to the address. Bringing CHERI Capabilities to Life in a Virtual Platform: CHERI ...

[2] Capabilities extend integer memory addresses (now 128 bit) and carry metadata such as bounds and permissions. Bringing CHERI Capabilities to Life in a Virtual Platform: CHERI ...

[3] CHERI ISA instructions enforce monotonicity of capability manipulation, so bounds can only be narrowed, never widened. Bringing CHERI Capabilities to Life in a Virtual Platform: CHERI ...

[4] A CHERI capability additionally carries permissions, an object type, reserved bits, and an out-of-band validity tag atomically bound to the capability. Bringing CHERI Capabilities to Life in a Virtual Platform: CHERI ...

[5] PoisonCap uses capability bounds to delegate memory-poisoning privilege so nested allocators can enforce temporal safety without disturbing upstream allocators. PoisonCap: Efficient Hierarchical Temporal Safety for CHERI

[6] Capability-indexed composition bundles programs with machine-checked capability bounds. Algebraic Semantics of Governed Execution: Monoidal Categories, Effect Algebras, and Coterminous Boundaries