For Vault Enterprise users, subscribe is a valid capability (ref) and should be included in the list of allowed capabilities.
subscribe