capabilities are sent by controller in a list, not a map