As a client developer writing an application, I want to have my application discover which endpoints are readable / writable through response values, and without having to know the intricacies of WordPress' capabilities system.

Currently, we can't easily support this use case because capability is determined at run time. We'll need some sort of framework for a WP_JSON_Controller to expose permission scope for its endpoints.