Section 5: Setting Capabilities explains how to initially set the capability defaults, and how to setup capability classes that you can use to define different account types.

If there comes a need where a user's account should change classes, then it is easy to administrate from the URI /admin/capedit.bml. Simply login as the system account, and apply (or unapply) the different classes as necessary for a specific user.

Setting the same capability twice.  If two capability classes set the same capability, and an account is defined under both classes, then the conflicting capability values are compared against each other, and the optimal setting is used where appropriate.