There are several default capabilities the bot uses. The most important of these is the owner capability. This capability allows the person having it to use any command. It's best to keep this capability reserved to people who actually have access to the shell the bot is running on. It's so important, in fact, that the bot will not allow you to add it with a command--you'll have you edit the users file directly to give it to someone.

There is also the admin capability for non-owners that are highly trusted to administer the bot appropriately. They can do things such as change the bot's nick, cause the bot to ignore a given user, make the bot join or part channels, etc. They generally cannot do administration related to channels, which is reserved for people with the next capability.

People who are to administer channels with the bot should have the #channel,op capability--whatever channel they are to administrate, they should have that channel capability for op. For example, since I want inkedmn to be an administrator in #supybot, I'll give him the #supybot,op capability. This is in addition to his admin capability, since the admin capability doesn't give the person having it control over channels. #channel,op is used for such things as giving/receiving ops, kickbanning people, lobotomizing the bot, ignoring users in the channel, and managing the channel capabilities. The #channel,op capability is also basically the equivalent of the owner capability for capabilities involving #channel--basically anyone with the #channel,op capability is considered to have all positive capabilities and no negative capabilities for #channel.

One other globally important capability exists: trusted. This is a command that basically says "This user can be trusted not to try and crash the bot." It allows users to call commands like icalc in the Math plugin, which can cause the bot to begin a calculation that could potentially never return (a calculation like 10**10**10**10). Another command that requires the trusted capability is the re command in the Utilities plugin, which (due to the regular expression implementation in Python (and any other language that uses NFA regular expressions, like Perl or Ruby or Lua or ...) which can allow a regular expression to take exponential time to process). Consider what would happen if someone gave the bot the command re [format join "" s/./ [dict go] /] [dict go] It would basically replace every character in the output of dict go (14,896 characters!) with the entire output of dict go, resulting in 221MB of memory allocated! And that's not even the worst example!