Just one pinprick: "discovering capabilities at runtime" is a security antipattern. There can never be wildcard roles. Every interaction must specify one (possibly composed) role.
Also worth noting: that sentence was just a historical aside about Fielding's original definition. The actual argument of the piece is that what most people call REST is really CRUD over HTTP, and that commands and queries are a better fit.