Invocation spec doesn't show how to deal with multiple parameters

[alanhkarp]

It is common to invoke a method on an object specifying one or more additional objects to be operated on. These additional objects may not have the same owner as the invoked object, which means permission to these additional objects needs to be delegated. It's also common for the invocation to create some new object as a return value to the invoker, permission to which needs to be delegated to the invoker. The invocation spec does not currently cover these cases.