Any pending op related to capabilities will be protected by application and user lock