It's a complicated topic -- it requires thinking about things in a different way, and tends not to make a lot of sense until at some point it "clicks" and you realize all sorts of patterns you were already using are actually special cases of capabilities.

Here is some reading:

https://capnproto.org/rpc.html#security

https://sandstorm.io/how-it-works#capabilities

http://zesty.ca/capmyths/usenix.pdf