[marcosdumay]

> whereby children can only be given access to capabilities their parents have

The one thing that makes capabilities usable is that they don't need to follow that rule.

If you don't have processes that let your programs get capabilities from any source other than their creation, you are better just adding your program names into your ACLs.