capabilities property
Replacement capability scope, applied wholesale, in the same explicit form as the
entry's. Omitted leaves it unchanged. {"scope": "ceiling"} returns the entry to
its role's full ceiling — a privilege INCREASE, bounded and gated like any
widening; {"scope": "none"} removes every capability; listed states the exact
set. There is no null form. Every listed capability is checked as on a grant
(registry, ceiling, additive, granter bound). A replacement that removes a
capability the entry held is a privilege reduction.
Implementation
final CapabilityScope? capabilities;