Controlling access to functions is common in programming languages, for security and for software engineering purposes. Often access control is based on a static type discipline, but this does not work in dynamically typed languages, and can be problematic in the presence of dynamic loading and reflection.

We argue that dynamically enforcing object-based encapsulation as part of the method lookup semantics is a more attractive approach. There is a natural affinity between object-based encapsulation and capability-based security. The Newspeak programming language capitalizes on this affinity. We have recently started enforcing access control in the Newspeak system. Here we report on our experience, from the perspectives of both implementation and usability.