Don't alot of those examples rely on some OS kernel - userspace separation? Does that mean creating a capability system requires some sort of underlying databas

Don't alot of those examples rely on some OS kernel - userspace separation? Does that mean creating a capability system requires some sort of underlying database that keeps track of capabilities and provides the actual functionality behind a capability, and a "userspace" that creates and shares these capabilities but can't access the underlying capability system.