Entities - migrate to user/group-level roles - new business access processes defined in policy

The draft policy imagines that directors and Authorized Legal Representatives (ALRs) will be allowed access to a business via specialized means.

### Director claim process:
1. Director applicant submits claim with any required corporate and identity information.
2. System notifies all affiliated directors.
3. A 10 business day objection period may apply.
4. If no objection is received, access is granted automatically.
5. Objections are logged in internal comments (FOI-disclosable) however filings and access continue.

### ALR claim process:
1. ALR submits claim and undertaking*
2. System notifies all affiliated directors.
3. ALR access is granted immediately (no waiting period).
4. Any subsequent objection is logged as an internal, locked, timestamped comment (FOI‑disclosable).

*ALR Claim and Undertaking details:
- Name of lawyer.
- Law firm (if applicable).
- Jurisdiction of legal practice.
- Digital undertaking confirming representation, confidentiality, revocability, and that the Registry relies on the undertaking without independently verifying representation.

Start by reviewing the director and ALR claim processes and the draft policy requirements described in the issue. Identify the existing access-control entry points and data flows that govern business access, then determine how completion will be verified against the notification, objection, undertaking, and timing rules.

Written by the indexing model from the issue text.