extra_x509_validation capability is not there in selecting specific capabilities for roles but it is given in documentation. Could you please confirm whether this capability is available in splunk 7.0.7.
https://docs.splunk.com/Documentation/Splunk/7.0.7/Security/Rolesandcapabilities
Per one of the comments on this question it appears to be removed, but still listed in the docs:
https://answers.splunk.com/answers/434089/what-does-the-capability-extra-x509-validation-pro-1.html
Also, at the bottom of the doc page you linked to there is a Feedback area. The Docs team at Splunk is super responsive if you provide feedback using that feedback mechanism. I asked them if the extra_x509_validation
is still available since it is listed on the Rolesandcapabilities page, but not within the authorize.conf spec documentation.