There is a set of ideas on how to separate some system that is assembled of capabilities between two or more machines without shared RAM or even disk. These ideas are not simple but you may be familiar with them. Imagine wire between two machines and wire connecting those two machines and a set of objects distributed between those machines but unaware of the split. Now imagine that both ends of the wire go to the same machine but that each end is connected to distinct sets of objects and that there no caps in one set to the other set. Now optimize by removing the wire and keeping the signals designed for the wire internal. Now you have a membrane between the two sets with no caps between but with an internal illusion of interoperation by capabilities.

For a glimpse of how this works there is between the sets the membrane M proper. For each program P in X that thinks it has a cap to C which is in set Y, there is a object C' produced and remembered by M that behaves enough like C to fool P. P really holds a cap to C'. When P sends a message to C' the message ends up with the “man in the middle” which is M. The data portion of the message is delivered to C but any capabilities in the message are transformed as follows:

• The capability may be a fake cap built earlier by M as an illusory reference to something in Y. M’s records are able to replace that fake cap with the real one.
• M may never have seen this cap, D, before and creates a cap to a new object D' that will be directly accessible to the recipient to the intercepted message. That fake D' may be passed about by members of Y and if it passes from Y to X the real D will be substituted.

In short M, the man in the middle, stays in the middle. If it should be necessary to sever the relationship, M and the fakes it has created is deleted and both X and Y see many stub end caps that have vanished. Going back to the wire analogy it is as if we had broken the wire.