In the context of Splunk, what does 'capabilities' refer to?

In Splunk, 'capabilities' specifically refers to the permissions that users have for different tasks throughout the platform. This encompasses what users can do within Splunk, such as creating saved searches, viewing certain data, managing users, or modifying knowledge objects. Each capability allows users to perform specific actions or access particular features necessary for their role in an organization.

While roles assigned to users determine a person's overarching level of access within Splunk, it is the capabilities defined within those roles that specify the precise permissions and tasks users can execute. The other options—data retention policies and user authentication methods—do not pertain to the concept of capabilities as it relates to user permissions, which is the core focus of this question.