30-second answer

capabilities prints one published description of what this engine can do: every collector, what each reads, the permissions it needs, whether it has been validated against a real tenant, and which rules consume it.

PowerShell
m365-governance capabilities

It exists so that nobody has to derive that answer. Before it, anything that wanted to describe this engine, including this site, had to join the rule files against the collection profiles itself, which made every consumer a second authority on the engine's own model.

What it prints

Text
m365-governance 1.0.0b6, contract 1.0.0b6

Capabilities
  activity
    when a person last changed something on one site
    reads      Get-PnPWeb, Get-PnPTenantSite
    needs      not-established
    live       live-validated
    rules      SPO-ACTIVITY-001

The four fields, and what each one refuses to overstate

reads is the surface, named as the commands it calls. It is what an administrator approves, not a description of what the collector wants.

needs is the permission. Where it says not-established, no minimum has been proven, and the engine says so rather than repeating a permission from documentation as though it had been tested. Establishing one means reducing an identity's permissions until the read fails, which is an experiment nobody has run yet for most of these.

live separates three states that reports usually merge:

StateWhat it means
fully live-validatedboth a successful read and a refusal have been observed against a real tenant
live-validateda real read produced real evidence
negative path validateda typed refusal was observed and no successful read. The collector behaves correctly when denied; what it returns when permitted is not established
not live-validatedoffline tests only. No rule should rest on this alone

rules is what consumes the capability. A capability with no rule is not broken: some produce inventory a person reads rather than a finding a rule makes.

Why a rule can exist with nothing to feed it

Two of the published rules read a fact no shipped collector writes. Against a real tenant they will answer unknown, every time, which is honest and is also a gap. This command is where that gap is visible, and it is meant to be: a catalogue that hides its own holes is the thing this engine exists to replace.

Exit codes

0 always, unless the engine cannot describe itself, which is a defect and not an answer.