They clearly mean capabilities.

https://en.wikipedia.org/wiki/Capability-based_security

> Capabilities achieve their objective of improving system security by being used in place of forgeable references. A forgeable reference (for example, a path name) identifies an object, but does not specify which access rights are appropriate for that object and the user program which holds that reference. Consequently, any attempt to access the referenced object must be validated by the operating system, based on the ambient authority of the requesting program, typically via the use of an access-control list (ACL).

> Instead, in a system with capabilities, the mere fact that a user program possesses that capability entitles it to use the referenced object in accordance with the rights that are specified by that capability. In theory, a system with capabilities removes the need for any access control list or similar mechanism by giving all entities all and only the capabilities they will actually need.

Some nice Object Capability technologies not mentioned in the Wikipedia article:

https://capnproto.org (used by Cloudflare)

https://spritely.institute/goblins (with wasm support via Hoot)

https://ocapn.org (where things come together in a future open standard)