Policy as Types in Object-capabilities