I think I should generally just redesign the system with completely managed capabilities -- for user process. Drivers can manage their own caps (if they want).
Still working on designing the user process environment, but this is a crucial detail which will unblock lots of stuff once solved.