Access ControlRules defining who can view, edit, share, or export vault content (roles, permissions, scopes).