Avoiding IBAC

Hi,

I was recently talking to some OwnCloud people.  They are building a
DropBox-like service for companies.  One access control policy that
they want to support appears to require IBAC: they want to allow
certain files to be shared with people in the same company, but not
people from outside the company.  Concretely, Alice should be able to
share a file with her co-worker Bob, but not be able to share it with
her colleague Carol at another company.  (Note: in this scenario,
Alice is not malicious.  The goal is to stop her from making a
mistake.)  I was trying to figure out how to do this with
capabilities, but I haven't come up with a solution.  Or perhaps, the
policy needs to be rephrased.

Thoughts?

Thanks,

Neal