ClaimCapabilityPolicies: Partial<Record<ClaimCapabilities, readonly string[]>> = {}

Extra IoT policies requested per claim capability, sent as the capabilities array on claim/verify and re-supplied on every re-claim or the policies drop.

Deliberately empty: capabilities is optional, and omitting it attaches no extra policies, which is correct for an ordinary device. Documented values are s3, kvs and bridge; which one a capability needs is a deployment decision, so entries are added only once confirmed.