> Sigh plan 9 did this years ago; without suid, without sgid, and without capabilities.
I'm no expert on Plan 9, but from a bit of quick googling it looks to me like it had local server processes to do privileged things for other processes that didn't have the rights to do them themselves. Which sounds rather like DBus/PolicyKit to me.