M3 - RBAC AuthZ - New authoring roles, tags, publishing isolated

Purpose
Introduce the new authoring roles you already defined, include taxonomy permissions in the model, and isolate publishing as an explicit permission boundary.

Definition of Done

• New authoring roles exist and are assignable.
  • Roles are created in AuthZ, show up in the Admin Console, and can be assigned and revoked using the M2 scopes.
  • Role descriptions and boundaries are documented, so admins understand what each role can and cannot do.
• Permissions are mapped and enforced for in scope Studio surfaces.
  • All actions in the in scope surfaces are mapped to permissions.
  • Enforcement in Studio respects those permissions when the flag is enabled, and remains safe to iterate on main.
• Taxonomy permissions are included.
  • Taxonomy related actions are mapped to permissions and enforced consistently with the new roles.
  • Any taxonomy actions that remain legacy only are explicitly listed as limitations.
• Publishing is isolated as a permission boundary.
  • Publishing is not included in any new role in this phase.
  • Legacy Staff and Admin retain existing publishing behavior.
  • The separation is explicit in the permission mapping and enforcement logic, so publishing does not leak through other capabilities.
• Known limitations and operational notes are documented.
  • Clear list of what is still legacy only, and how admins should reason about access during the transition.
  • Troubleshooting and escalation path for access issues.

Dependencies

• M2 Admin Console flows and scopes are live.
• Staging is available for validation.
• Tech confirms publishing isolation approach.

Start by reviewing the live M2 Admin Console flows and scopes, then trace how AuthZ roles and permission mappings reach the in-scope Studio surfaces. Validate the behavior in staging with taxonomy actions and publishing scenarios. Done means new roles are assignable, permissions are enforced, publishing remains isolated, and limitations and operational guidance are documented.