Proposal for capabilities

> ssh would be policy

Is policy distinct from authorization rules as described in kubernetes?  Kubernetes authorization is entirely focused on security access to resources (read/write access to replicationControllers, etc) and doesn't attempt to control anything at the action level.