Is it? My understanding is access control lists are typically static, and on resources, defining what is allowed to access them, or on processes/threads/etc, defining what they are allowed to access. If you get a capability from something, and that something eventually becomes invalid, making the capability invalid, is keeping track of that necessarily an access control list? Is any data structure double-checking operations like that always necessarily an access control list? If each capability has a reference to a parent that it relies on to remain valid, does that mean each capability stores an access control list for itself?

If your answer to all of these is "yes, that's an access control list" then my response would be to start ignoring the presence of an access control list as it ceases to mean much of anything.

One of the strategies with capabilities is that I do not hand you the capability that I own to X. Instead, I create a proxy Y that can make requests of X, and then hand you the capability to make requests of Y.

If I later stop Y, you lose access.

This can be viewed as a kind of provenance. The history of how the access came to be is reflected in the actual capability. The downside, obviously, is that we've added overhead. But this strategy can allow us to do a number of interesting things. Like split an existing capability into multiple finer grained ones.