extra_x509_validation capability is not there in selecting specific capabilities for roles but it is given in documentation. Could you please confirm whether this capability is available in splunk 7.0.7.
Also, at the bottom of the doc page you linked to there is a Feedback area. The Docs team at Splunk is super responsive if you provide feedback using that feedback mechanism. I asked them if the extra_x509_validation is still available since it is listed on the Rolesandcapabilities page, but not within the authorize.conf spec documentation.