-record(capability, {
    action :: aarondb@auth:action(),
    resource :: aarondb@auth:resource()
}).