Function required_capability_for_admin_request 

pub fn required_capability_for_admin_request(
    req: &AdminRequestKind,
    scope: AuthorityScope,
) -> &'static str

Static capability string required to satisfy req under scope.

Pure function — the mapping can be unit-tested in isolation. Every variant has an entry; there is no default-allow arm.

self:* forms apply when the target principal is the caller themselves; admins operating on another principal need the unscoped quota:set / caps:grant forms. Group admin is always global — there is no “self” variant of group:create.