Use capabilities for profiles (as opposed to child subsystem capabilities), socket-binding-groups (as opposed to the already implemented [outbound-]socket-binding capabilities), server-groups and server-configs. Replace some of the custom reference validation with capability resolution.