Limited Spend

Suppose I have a capability allowing unfettered access to my bank account. I
could hand a capability to Alice, who I partially trust, that could be used to
spend up to some limit directly from my bank account. Alice could then go
and buy something on my behalf using that capability ... or steal the money
from me. But Alice could not steal or spend any more than the limit I had set.
Furthermore, until Alice does actually spend the money, it remains available to
me in my bank account, so this is not the same as actually giving the money to
her.
Also, if I thought I might change my mind later, I could first wrap the bank
account capability in a revocable capability, and then wrap the revocable capability
in the limited-spend capability. Note that the limited-spend capability
would not need to know whether the account-access capability was revocable or
not.