So the way to prevent robots from throwing people of a cliff is to use a capability system that only allows robots to kill people when explicit authorized?