Short answer: if you know how CHERI and SoftBound do it, then Fil-C is basically like that.

Long answer: let's assume 64-bit (8 byte pointers) without loss of generality. Each capability knows, for each 8 bytes in its allocation, whether those 8 bytes are a pointer, and if so, what that pointer's capability is.

Example:

    char* p = malloc(64);

This will allocate 64 bytes. p's capability will know, for each of the 8 8-byte slots, if that slot is a pointer and if so, what it's capability is. Since you just allocated the object, none of them have capabilities.

Then if you do:

    *(int**)(p + 8) = malloc(sizeof(int));

Then p's capability will know that at offset 8, there is a pointer, and it will know that the capability is whatever came out of the malloc.

Hence, each capability is dynamically tracking where the pointers are. So it's not a static type but rather something that can change over time.

There's a bunch of engineering that goes into this being safe under races (it is) and for supporting pointer atomics (they just work).