One can try to apply those principles to other areas where this problem shows up. Should help unless the constraints enforce broken designs as many legacy technologies do.
This is why in UNIX-like systems, file/device permissions have to be checked using the authorisation that was in place at open() time and not at write() / read() time; this allows passed or inherited file descriptors to function like capabilities in this sense.
For example, when you run a setuid binary, it inherits file descriptors (stdin, stdout and stderr) that were opened by the caller - to prevent a certain class of confused deputy attacks, writes and reads on these file descriptors should not use the elevated privileges of the binary but the original privileges of the opener.
I would also suggest that a huge class of issue stem from unified permissions so any access means total access. Unix goes for CRUD (Create, Read, Update, Delete) which has become fairly standard, but often adding a new class of permission like Append (for log files) simplifies a lot of security issues.
That's not really what the confused deputy problem is about.
Instead, a confused deputy has too much authority, and is being asked to "switch hats" and pretend to have the authority of a user/caller.
Confused deputies arise because they don't have a clear picture of what the authority of the user/caller actually is, and accidentally expose some authority that the user/caller wasn't supposed to have.
Capabilities let you model this authority as a first-class principle.
In principle that's true, but let's consider something like auto run when inseting a USB or CD etc. When auto run means full user permissions to run any program that's a huge security issue. If on the other hand auto run is specifically a dialog box based on the device format that's a much smaller security issue.
The point being if you give an app permission to add a charge to a bill and only add a charge to a bill then the fact a user can increase there bill in an arbitrary fashion is still a problem, but it's a smaller one than letting them delete all charges.
https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_fi...