You will build a portfolio, publish a product into it, constrain what that product may do, entitle a role to see it, and then swap hats and launch it as a consumer. Five tasks, one idea: a preventive control can hand out capability without handing out permission.