On the topic of capabilities and browser code: google native client

I know nothing about the trust and/or capabilities model in google native
client, but I wonder what it's trust and cap model is.

http://arstechnica.com/news.ars/post/20081209-safer-than-activex-a-look-at-googles-native-client-plugin.html

cheers,
Dave