Add a capability enforcement integration test.

This should ensure that no / yes and enforce work the way we want.