No, performance is not usually cited as a reason against capabilities. Capability-based authorization usually has near-negligible cost to evaluate -- certainly

No, performance is not usually cited as a reason against capabilities. Capability-based authorization usually has near-negligible cost to evaluate -- certainly less than the cost of evaluating ACLs. The problem with capabilities is that you have to design your code differently to use them effectively.