CRED: Wrap task credential accesses in the capabilities code