Internal function calls are checked wrt their caller capabilities. When a function calls originates from outside the contract, the caller capability is checked at runtime.

Previously, caller capabilities were checked at the entry of each function at runtime. Now, at runtime, they're only checked for the entry function. The subsequent caller capability checks are validated at compile-time.