I've looked at Capnproto in the past but did not read through the documentation thoroughly enough to see the bits about capabilities (or the link to the pdf version of the same myths article I linked above!)
>For Sandstorm, we actually don't quite want that, because we want the document owner to be able to see how their document has been shared. So, to share a sturdy ref, we require you to restore it to a live ref and delegate that. The recipient can save a new sturdy ref tied to them.
@bascule alluded to this, but this can actually be very nicely modeled with macaroons! The idea would be to create a capability-granting macaroon but attach a "third party caveat" that asserts the grantee must be able to prove they are the "authenticatable identity". You end up with the same properties as the live/sturdy refs, if I understand properly.
Mostly it's just cool to see different implementations of capability-based access control.