One cool feature of the Common Fabric runtime: type narrowing.

A caller can give a handle to an object where they have fewer capabilities on the object than their callee does.

That allows the caller to not be tainted unnecessarily.