The BERI CPU, the CHERI ISA and CheriBSD has an interesting approach to this, where they have capability-based addressing at the pointer level, supported by hardware.

https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/