inab

Thank you for answering so quick.

So it seems that ability is given by role type, not by capabilities.
Our solution uses users as Subscribers with enhanced capabilities, due to a Role Scoper plugin schema.