RBAC + Business Domain Scope, approval, lock, audit, QA.

API-backed implementation continues in the next sprint.