It's a step in a positive direction that Deno makes you explicitly grant a script permission to do some things, but that's not at all what is meant by capabilities, and that's absolutely the wrong word to use to describe it. A capability is a first-class concept that exists at runtime, and is a value you must pass to dependencies that need it. You should also be able to use it to create new, dependent capabilities with fewer rights, and they should in general be much finer-grained than "can access the internet" to be of real use.