And that capabilities model is one of the big differences in Pony and was the key to achieving Pony's parallel lock-free provably correct concurrency model.
Most lang/system capability models (including Go's) are open from the start -- where anyone can do anything -- and then when designing the lang/system you try to restrict access between some things at some of the time, but this gets messy fast and it's hard to get right and thus it's almost never optimal.
So rather than trying to start with an open model that's inherently flawed by definition, Pony flips the model on its head and begins from the perspective that everything is denied unless specified. You would say Pony has a deny-first capabilities model, which you can see explicitly defined here in Pony's capabilities matrix...
And if you listen to Sylvan's talks, he is emphatic that solving the capabilities problem upfront was key that made everything else possible. All the other cool stuff you hear about in Pony like the provably correct runtime and finally achieving something approaching Hewitt's elusive Actor model that's been theoretically true for 40 years but never fully realized. Well the key to solving that mystery and unlocking the door was to take a new view on the capabilities model and building everything off that from the start.