Proposal for capabilities

> PUT/POST/UPDATE/GET are our existing verbs.

Authorization so far has no concept of verbs it only deals with readonly or not and kinds.  It doesn't have a concept of parameters either.