Currently the "enrol/lti:config" capability is used in both checking if a user can "publish" a resource as LTI tool, and "see" published content via Deep Linking.

There are some cases where an administrator may want to limit access to the "Publish as LTI Tool" permission, while still allowing external teachers to use any already published resources to use on their own platforms. It should make sense to have two separate capabilities for these two scenarios (like a permission for "writing", versus a permission for "reading").