The capabilities model doesn't prohibit you from creating a UI that implements those features. It just acknowledges that you're making UI restrictions, you're n

The capabilities model doesn't prohibit you from creating a UI that implements those features. It just acknowledges that you're making UI restrictions, you're not really prohibiting delegation, because prohibiting delegation is impossible. For example, a good capability-based sharing system should have a way for a user to indicate that resharing of some resource is not allowed. The effect of enabling this is that the regular sharing UI will be disabled for those people who "aren't supposed to" reshare. This UI might look exactly the same to the user as an ACL-based implementation would. This may sound "weaker" somehow than the ACL system, but it actually isn't, because neither system actually securely prevents resharing. Both merely make it inconvenient, forcing the user to go out of their way to break policy.