Do you need a Capability policy?

Do you need a Capability policy?