30-second answer
capabilities prints one published description of what this engine can do:
every collector, what each reads, the permissions it needs, whether it has
been validated against a real tenant, and which rules consume it.
m365-governance capabilitiesIt exists so that nobody has to derive that answer. Before it, anything that wanted to describe this engine, including this site, had to join the rule files against the collection profiles itself, which made every consumer a second authority on the engine's own model.
What it prints
m365-governance 1.0.0b6, contract 1.0.0b6
Capabilities
activity
when a person last changed something on one site
reads Get-PnPWeb, Get-PnPTenantSite
needs not-established
live live-validated
rules SPO-ACTIVITY-001The four fields, and what each one refuses to overstate
reads is the surface, named as the commands it calls. It is what an
administrator approves, not a description of what the collector wants.
needs is the permission. Where it says not-established, no minimum has
been proven, and the engine says so rather than repeating a permission from
documentation as though it had been tested. Establishing one means reducing an
identity's permissions until the read fails, which is an experiment nobody has
run yet for most of these.
live separates three states that reports usually merge:
| State | What it means |
|---|---|
fully live-validated | both a successful read and a refusal have been observed against a real tenant |
live-validated | a real read produced real evidence |
negative path validated | a typed refusal was observed and no successful read. The collector behaves correctly when denied; what it returns when permitted is not established |
not live-validated | offline tests only. No rule should rest on this alone |
rules is what consumes the capability. A capability with no rule is not
broken: some produce inventory a person reads rather than a finding a rule
makes.
Why a rule can exist with nothing to feed it
Two of the published rules read a fact no shipped collector writes. Against a
real tenant they will answer unknown, every time, which is honest and is
also a gap. This command is where that gap is visible, and it is meant to be:
a catalogue that hides its own holes is the thing this engine exists to
replace.
Exit codes
0 always, unless the engine cannot describe itself, which is a defect and
not an answer.