I tried twice with XOS and Demos/MP.  XOS was a traditional capability system,
Demos a less traditional and more usable one.  XOS was mine, Demos/MP from
Los Alamos/Stanford.  Demos is described in an old SOSP (in the 70's),
XOS in a OSR in the 80's.  We had the usual problem with persistence;
garbage collecting the capabilities, revoking old capabilities, building
tools to walk the arbitrary graphs that resulted and make some sense of
them, ...  Even something like tar turned into a major pain in the backside
to build.  When you gave someone a capability, you had to do a transitive
closure of the access of that capability to figure out what you were giving
away or restrict the capability to be intransitive.  The result was
a lot more copying.

On the positive side, access control was nicer.  Unfortunately, that was the
only plus.

I keep believing that capabilities are a good idea but the concept requires
someone better than me to implement.