Function derive_capabilities 

pub fn derive_capabilities(
    principal: &str,
    entries: &[AclEntry],
) -> Capabilities