From 303663e48b7e0df4d281191b38f8793e0727fbed Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Thu, 19 Mar 2026 21:41:24 +0100
Subject: [PATCH] Enhanced scope with provided capabilities

---
 SCOPE.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/SCOPE.md b/SCOPE.md
index 2630c8a..23eb5e6 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -90,6 +90,24 @@ NetKingdom applications target the "NetKingdom IAM Profile" — a versioned OIDC
 
 ---
 
+## Provided Capabilities
+
+```capability
+type: security
+title: OIDC/PKCE authentication (lightweight mode)
+description: Provides OIDC/PKCE endpoints conforming to the NetKingdom IAM Profile via Authelia + LLDAP + privacyIDEA — a drop-in Keycloak alternative for constrained environments.
+keywords: [oidc, pkce, authentication, iam, sso, authelia, lldap, mfa, identity]
+```
+
+```capability
+type: security
+title: Identity migration tooling
+description: Migrate identities between lightweight (KeyCape) and expanded (Keycloak) IAM modes — LLDAP export, Keycloak import, LDIF generation.
+keywords: [migration, identity, lldap, keycloak, ldif, iam]
+```
+
+---
+
 ## Getting Oriented
 
 - Start with: `wiki/KeyCapeSpecification_v0.1.md` (architecture and design intent)