Hi David

The default capability would be what is showing in the authenticated user role as all logged in users are given this role - this also seems to be not set.

I think that setting audience based visibility on means that the hidden permission is not applicable so defaults to not set

regards