Proposal for capabilities

It is both, policy is preventing access to actions that have been disabled globally (features that have been turned off), whereas admission control is checking for globally configured resource constraints.  I'll change the word "may" though.