Generally, all OpenPGP primary keys have the certification capability
C. You cannot have one without it, it is required to certify (sign) other's key, perform key management operation like creating and revoking subkeys and user IDs.
Revoking the primary key means you have to exchange keys again with your communication partners, lose all the reputation in the web of trust, ... It is recommended not using the primary key for any "day to day" tasks like encryption
S and authentication
A. Adding a pair of subkeys is cheap and easy, it just takes some seconds and storage requirements and negligible.
You rarely need to use the certification capability functions, that's why some people move those keys to an offline location: a thumb drive, another (old) computer dedicated for this purpose, OpenPGP smartcards.
To wrap up the recommended key setup is something like
- primary key, capability
C (you might want to keep it offline)
- encryption subkey, capablity
- signing subkey, capability
S (some people use additional signing subkeys for different computers)
- authentication subkey, capability
A (but probably you'll not need and use it)
(with of course each of those forming a public/private key pair).