> That's what I'm calling capabilities at the application level (where you say "this .jar can't access the network"), rather than at the language level (where you say "this function wasn't given access to the network as an argument")

it wasn't, it was done at the type and classloader level

have a read about SecurityManager