There a sort of “might makes right” principle here. If you can do it, you can mint a capability for it, which means you will perform the action when someone with that capability requests it.

A central authority is not a requirement. What is required is some way making sure capabilities are unforgeable.

This can be a central authority, which then has a completely mechanical task of registering capabilities and their ownership. But it can also be ensured “cryptographically” with a key.

The OS already has a capability system called “file descriptors”. Which works quite well, within its limited scope. This could be expanded out to more areas.

The question is - how do you get the ability to write to pathA and to pathB but not to pathC, while another user gets the ability to write to pathA and pathC but not to pathB?

Do you get a huge list of capability keys when you log into the system, one for each path? Do you ask a service for a capability when you want to perform the action?