Confusing intro sentence

[samuelweiler]

I had trouble making sense of

As a threat model, this specification describes attacker capabilities and attacker goals, and says which goals which capabilities should and should not enable.

On the first three readings. How can we say this more clearly? (emphasis added)