it looks good to me - i initially misread and thought the RBAC was in the module, but I see it is in the example my bad.

I think it is important modules support ALZs. After all, beautifully crafted LZs with all the policies and CAF practices is what we should be deploying into (oh look, there goes a unicorn 😸).

edit - a minor point - I think the variable should set nullable = false - it'll either be system or the resource ID, if I'm understanding correctly?

Good to see this being incorporated. 🚀