Identity Manager defines Capabilities as:
Task-based. These are capabilities at their simplest task level.
Functional. Functional capabilities contain one or more other functional or task-based capabilities.
Built-in capabilities (those provided with the Identity Manager system) are protected, meaning that you cannot edit them. You can, however, use them within capabilities that you create.
Protected (built-in) capabilities are indicated in the list with a red key (or red key and folder) icon. Capabilities that you create and can edit are indicated in the capabilities list with a green key (or green key and folder) icon.