In Keykos if the test is on the input, the attenuator can choose to reject the request and respond as P would for invalid requests. If the request is OK then the attenuator can pass the resume key for the requestor on to P and the response need not travel back thru the attenuator. If the test involves the reply, then the attenuator can invoke P and condition the reply to the requestor on both the request and P’s response.
If the legacy code wields a rescindable version of P and the rescindable logic is prepared for upgrade, then the restriction can be put in place while the system remains in service and no reinstallation is needed.
An attenuated capability can impose novel restrictions on the actions possible or the information available thru a capability. For instance I can attenuate a read-only access to a key accessed collection to only access records with keys ending in “ski”, or zip codes for southern states. I can do this polymorphically with a small amount of code and probably rather good performance contrasted alternative solutions to such problems.
In Keykos I can even attenuate a segment to provide access to even numbered bytes but not odd numbered bytes. To do this I must have notification of changes to the original segment. The segment keeper of the original segment is in a position to do this, but most current keepers do not.
The Keykos kernel provides means for attenuating a segment my making a weaker segment that is a: