The kernel maintains a table of which handle values each process owns and uses that to check the capabilities of the calling process when handling a syscall. Sending a capability in a message updates this table as the ownership changes.

We use (somewhat) large and non-dense numerical values for handle values to reduce the risk of accidental reuse of values.