replaced roles with capabilities