Per-object capabilities / custom policies

Is there a way to manage capabilities not for whole custom type (working with every object/instance of this type), but only with single object/instance?

Or is there a way to create custom capability policies that will execute some function and grant/deny permissions based on this function result?

For example I have custom types “Books” and “Reviews” connected by relationship (from plugin). I want to block users from adding reviews for some books, not for all depending on settings in Book object they refer to. I guess it could be based on custom Books status like: “Blocked from review” and “Allowed for review”.