Capabilities themselves can certainly be implemented at a very low level; you might implement them as an array of capabilities associated with each process: https://en.wikipedia.org/wiki/C-list_%28computer_security%29

As that page points out, POSIX file descriptors are effectively c-lists. A capability operating system would use similar mechanisms to control access to resources other than just open files.

The other things GP mentioned (logging, interdiction, UIs for visibility/control, etc) are layers that you would implement on top of the lowest-level capability system.