To extend the analogy I guess you can also add to this revocable capabilities if you selectively indirect through a mutable oracle store with random GUIDs as keys and content hashes as values. You should end up with some kind of forward-secure version of the downward-closure property where you can only access content which is reachable from known content hashes without going through revoked links.