@sean

the beauty of capability URIs are that they never have to be revoked: they are opaque identifiers which have no discernable meaning (they are a UUID basically).

a good example of where capability URIs have been battle tested and proven to be a hero is in Second Life where they are used basically everywhere.

it's when you use tokens that directly link back to identity that you get into the whole mess of having to rotate and revoke.