Entities - migrate to user/group-level roles - Deploy and configure a Zanzibar implementation

Assumes that enough business decisions and policy are final that we can define the access model.

No files, tests, or entry points are named. Start by reviewing the finalized access-model decisions and locating the repository's deployment configuration; clarify which Zanzibar implementation, environments, and user/group role behavior are in scope. Done should mean the implementation is deployed and configured, but the issue does not define those acceptance checks.

Written by the indexing model from the issue text.