Proposal for capabilities

Which component is responsible for checking capabilities for an account?  Based on my read, it's admission control, but I'd like to be sure.