Author entity access rules (GRANT) over MCP/PED via domain-model path-ops; security role/user docs are sealed

Author entity access rules (GRANT) over MCP/PED via domain-model path-ops; security role/user docs are sealed #395