Ask HN: Composable Capabilities?

In unix, you can compose operations by piping text between various tools.

What would it look like to be able to compose capabilities (as in [1]) in the same manner?

For example, to build a capability that only allowed read-only access to files in /usr/foo/*, and run process bar with it

[edit] Would "gencap /usr/foo/* c| capreadonly c| crun bar" be reasonable?

Where c| was a capability pipe?

If capability based security is to ever take off, this will have to be one of the building blocks. I'm having trouble even imagining what kind of syntax or tooling would be required.

[1] - https://en.wikipedia.org/wiki/Capability-based_security