We requires OPA policy enforcement on RBAC entity types - specifically Role, Resource Group, and Role Assignment — evaluated On Save. Additionally, the existing User Group On Save policy set is not being evaluated when a group is created or updated and needs to be fixed or enabled. The use case is enforcing guardrails for delegated project-level admins who have permissions to create user groups, roles, and resource groups, but must be prevented from granting admin-level access. Examples include blocking admin-named groups or roles, restricting Administrative Functions permissions to View-only in custom roles, and preventing binding of admin roles. RBAC alone cannot express these constraints since Role Create/Edit and Manage User Groups are all-or-nothing permissions. Please add OPA policy support for the missing entity types and fix evaluation for User and User Group policies.