"Admin"'s identity is the resource you're asking permissions to use. If don't want identities, are you going to manually authorize every file that needs to be interacted with? For a recursive delete of thousands of files?

You would authorize deletion in a specific directory.

Is that the shiny new capabilities based future that never arrives?