Which of the following statements applies to a capability-based approach to authorization?

a. The mechanism associates with each resource a list of users who can access the resource together with the action privileges that each user has with respect to the resource

b. The mechanism assigns capabilities to a user as a function of the class into which the user's password falls

c. The mechanism assigns privileges to users only if they know the password for each resource

d. The mechanism associates with each user the resources they can access together with the action privileges they have with respect to each resource