Network services, ranging from simple network paths to complex packet processing and content storage, are envisioned as a core aspect of the future Internet. One key challenge is to limit access to these services to traffic that is authorized to use them. In this work, we describe a novel design for data plane capabilities that can provide efficient access control at high-data rates.