To my mind, Ross Anderson was being pragmatic, when he insisted in his text "Security Engineering, 3e" that computer & information security models should more closely reflect underlying human trust relationships, and it could be said that capabilities models let one achieve that more readily, than the constant exercise of trying to close gaps exposed by security models rooted solely in Access Control Lists (ACLs), which amount to a form of fire-fighting; hence the HP Labs paper by Tyler Close, "ACLs Don't", which sadly got an IEEE reject. https://www.cl.cam.ac.uk/archive/rja14/book.html