A Capability is an unforgeable ticket, which when presented can be taken as incontestable proof that the presenter is authorized to have access to the object named in the ticket. A capability can also be thought of as a secure pointer. In order to be useful, they must not be directly accessible in any address space available to a user process. In general, capabilities are faster to process than access control lists. Authentication is the verification of the identify of a person making a request.
Authorization grants a principal access to certain information.
An Access Matrix is a matrix with the rows representing principals and the columns representing resources. Each entry is thus an access right. A given row represents what resources a principal has access to, or its capabilities. Each row represents what principals can access a resource, essentially an access control list. Access Matrices are a way of modeling the access rights, but it is not usually done this way due to its sparseness.