That's my observation as well, but I think this is a shame: It has tremendous advantages for principle security (i.e. the security of the owner of the data, as

That's my observation as well, but I think this is a shame: It has tremendous advantages for principle security (i.e. the security of the owner of the data, as opposed to the security of the owner of the database). For example: I have a helpdesk, where I need operators to be able to look up the details of users, but only when the user requests it. My users compute the capability string and give it to the helpdesk operator (who cannot merely give it to other helpdesk operators- they have to compute a new capability string showing the chain of custody).