What are the key differences between access control lists and capability lists in terms of controlling access to resources?

Access control lists (ACLs) are a list of permissions attached to an object that specify which users or groups are granted access to that object. Capability lists, on the other hand, are a list of permissions attached to a user that specify what resources that user can access. The key difference is that ACLs control access based on the object, while capability lists control access based on the user.