pub fn derive_capabilities_for_host( principal: &str, peer_host: &str, entries: &[AclEntry], ) -> Capabilities