Hi
Not so easy.
The sample you might have seen is using the session object.
In your case you need to get all memberships, as well as the memberships of the memberships, of the user and test them against the existence of the membershiplist and the user itselft of the capability. There is a function to get all role and group memberships of a user but it does not recognise :: - roles like camid(::System Administrator). So your result may become inaccurate.
Have fun.