Capability integrity and application identity