Capability-based security is to be contrasted with an approach that uses hierarchical protection domains.
hierarchical protection domains, often called protection rings, are mechanisms to protect data and functionality from faults (by improving fault tolerance) and malicious behaviour (by providing computer security). This approach is diametrically opposite to that of capability-based security.
Are capability-based security and hierarchical protection domains for different purposes? Or are they different methods for the same purpose?
In what sense are the two approaches are completely opposite to each other?