PLINK-286 foundational infrastructure for privilege inheritance