Post type capabilities use the 'capability_type' argument as a base, if the capability is not set in the 'capabilities' argument array or if the 'capabilities' argument is not supplied.
The capability_type argument can optionally be registered as an array, with the first value being singular and the second plural, e.g. array('story, 'stories') Otherwise, an 's' will be added to the value for the plural form. After registration, capability_type will always be a string of the singular value.
By default, seven keys are accepted as part of the capabilities array:
edit_post, read_post, and delete_post are meta capabilities, which are then generally mapped to corresponding primitive capabilities depending on the context, which would be the post being edited/read/deleted and the user or role being checked. Thus these capabilities would generally not be granted directly to users or roles.
edit_posts - Controls whether objects of this post type can be edited.
These four primitive capabilities are checked in core in various locations. There are also seven other primitive capabilities which are not referenced directly in core, except in map_meta_cap(), which takes the three aforementioned meta capabilities and translates them into one or more primitive capabilities that must then be checked against the user or role, depending on the context.
These additional capabilities are only used in map_meta_cap(). Thus, they are only assigned by default if the post type is registered with the 'map_meta_cap' argument set to true (default is false).