There's a paper called "Capability Myths Demolished" that addresses this. There's an online version here[0], see "revoking access".

Personally I'm fascinated by ocap systems and am always looking for ways to employ them. There are some interesting "modern" applications (aside from a couple of research kernels) like CapnProto and Pony language. Macaroons come close but are more of a hybrid approach to authorization. (They don't out of the box prevent confused deputy or anything)

[0]: http://www.erights.org/elib/capability/duals/myths.html