As it was explained to me, the main problem with capabilities is working out how to revoke them.<p>You either have expiring capabilities, which is a hassle but probably inevitable. Or you have revoked capability lists, imposing an additional cost on every single invocation. The latter was a bit of a killer once people had figured out clever, fast bit-operation ways to check a capability, because the cost of looking up the list swamped the gains from bit-twiddling optimisations.<p>Mind you, we sorta wound up with it anyhow, in the form of OAuth tokens. And here the algo-economics changes again to favour it: the cost of a network roundtrip is <i>gigantic</i> compared to any comparison operation, so it doesn&#x27;t seem quite so bad after all.