a chicken or egg problem?

The problem with adding descriptors is that you really want them under access control. And to implement access control, you really want descriptors.

So I'm thinking of decoupling access controls and making users first-class objects (Topics). Converting users to Topics can wait. But before we do too much with descriptors, we need access controls.

Then the first thing we will find in a Descriptor unit is perhaps a list of who can make changes to a Topic and who can change the DescriptorUnit of a Topic. The rest can wait.