The permission blueprint: feature groups → resources (with supported actions) + templates. Drives the permission-set editor and the effective-access matrix.