Note that I'm answering your question with two examples that would and might be considered OS's because they themselves had to implement the capability model in

Note that I'm answering your question with two examples that would and might be considered OS's because they themselves had to implement the capability model in generic ways and with principles you might find useful in non-OS work. Especially with prevalence of things like containers, browsers, and full-on interpreters that are like mini-OS's. I have some non-OS examples, though. KeyKOS/KeySAFE was a whole, capability-based platform designed for high-security: http://www.cap-lore.com/Agorics/Library/KeyKos/keysafe/Keysafe.html http://www.cap-lore.com/Agorics/Library/KeyKos/keysafe/Keysa... Rees did a security kernel for Scheme48: http://mumble.net/~jar/pubs/secureos/secureos.html http://mumble.net/~jar/pubs/secureos/secureos.html Waterkin server for web apps done with capability-secure version of Java: http://waterken.sourceforge.net http://waterken.sourceforge.net DarpaBrowser was written in E language: http://www.combex.com/tech/darpaBrowser.html http://www.combex.com/tech/darpaBrowser.html Pony is used for Wallaroo. It presumably uses reference capabilities: https://blog.wallaroolabs.com/2017/10/why-we-used-pony-to-write-wallaroo/ https://blog.wallaroolabs.com/2017/10/why-we-used-pony-to-wr... https://tutorial.ponylang.org/capabilities/reference-capabilities.html https://tutorial.ponylang.org/capabilities/reference-capabil... Edited to add Cap n Proto for IPC. Thanks kentonv for reminder. Should not have forgotten! https://capnproto.org https://capnproto.org