Recent processors have a privileged bit that grants or denies access to the floating point state and function of the processor. Perhaps the original purpose was to avoid the cost of loading and storing that state upon switching between processes that do not use the floating state. If a domain (process) conceptually accesses its floating state via a capability then two processes can share the floating state which makes loading and saving state unnecessary when those processes send messages to each other.
The 360, 370 & 390 architectures make all I/O devices conform to the "channel architecture". Each device has an address. The channel controller sits so that it can access physical memory to which or from which to get data. The channel also fetches channel commands which describe such transfers by real memory addresses. KeyKos provides a rescindable capability for each device. With the device capability a program can provide a segment and a channel program describing I/O activity for the specified device with the segment in the role of memory. The kernel translates the channel program into one with real addresses which the channel then obeys. The other kernel I/O is the disk I/O used by the kernel to access home and swap locations for pages and nodes.