Apple has published a fairly detailed document on which I comment here.
Capabilities provide ample mechanism for institutions to carve out their own space and install their own function while leaving a whole iPhone (less some space) to the user.
The user need not trust Apple to skim code for suspicious system calls. Relevant bad actions are caught at run time in concrete situations rather than hypothetical situations that the Apple engineers may not have thought of. If I want to run a new instance of tetris it does not require much savvy for the user say no when tetris asks for a contact list. Unlike the usual Apple dialog box asking for sweeping authority by some poorly defined entity, such a request would be manifestly from tetris. We have several hundred thousand years of evolution behind us that responds well to these situations.