In other words, basically treat the driver initialized to talk to the client-device the way mobile iOS treats apps: start them off with no capabilities, and then make them ask the OS to prompt in order to get persistent capability tokens granted.