Object Capability Enforcement using Private Fields and Brand Tokens

class AccessToken {
  #scope: string;
  constructor(scope: string) {
    this.#scope = scope;
  }
  static grant(scope: string): AccessToken {
    return new AccessToken(scope);
  }
}
 
class SecureVault<T> {
  #data: T;
  constructor(data: T) {
    this.#data = data;
  }
  public read(token: AccessToken): T {
    if (!(token instanceof AccessToken)) {
      throw new TypeError("Unauthorized access attempt");
    }
    return this.#data;
  }
}