The question is - how do you get the ability to write to pathA and to pathB but not to pathC, while another user gets the ability to write to pathA and pathC but not to pathB?

Do you get a huge list of capability keys when you log into the system, one for each path? Do you ask a service for a capability when you want to perform the action?