They don't out of the box form an ocap system but there's nothing preventing you from making one with them. That's something I've been meaning to explore more in-depth.

Here's a good discussion on the differences between macaroons and capabilities: http://www.eros-os.org/pipermail/cap-talk/2014-December/0163... (see the "Macaroons: Capabilities vs Credentials).