The wikipedia page on capability-based security states:
Capability-based security is to be contrasted with an approach that uses hierarchical protection domains.
However, in order to implement capability-based security, we still need a kernel that ensures that user processes are only able to use the capabilities they have been assigned. Hence we still need a distinction between kernel mode and user mode, which is exactly what hierarchical protection domains are. In fact, as far as I know, most OS'es use only 2 hierarchical protection domains (user and kernel) in practice (I think Windows 10 has domains 0,1,2,3, but that 2 and 3 are only rarely used).
So it seems to me that kernels that implement capability-based security do not make less use of hierarchical protection domains than other operating systems.
Isn't it more accurate therefore to say that capability-based security is one way of using hierarchical protection domains to achieve security? (rather than fundamentally different from hierarchical protection domains)