A Formal Model for Capability Machines An Illustrative