There a sort of “might makes right” principle here. If you can do it, you can mint a capability for it, which means you will perform the action when someone with that capability requests it.

A central authority is not a requirement. What is required is some way making sure capabilities are unforgeable.

This can be a central authority, which then has a completely mechanical task of registering capabilities and their ownership. But it can also be ensured “cryptographically” with a key.

The OS already has a capability system called “file descriptors”. Which works quite well, within its limited scope. This could be expanded out to more areas.