tame() isn't a capabilities-based approach. Don't confuse POSIX capabilities with actual capability-based security. The former hijacked an existing term to refer to a different thing.

It's pretty obviously a limited API, but it also makes privilege dropping absolutely trivial. Which is the point.