Move event locking logic into RBAC business rules.