One grammar for everything
A table, a camera and a server share one identity grammar: prx:tenant:pillar:site:type:id. Every access decision is asked of one policy decision point, and the answer is recorded on one hash-linked audit chain.
The payoff is that an access review is a single question, and a refusal explains itself: a 403 names the policy that produced it.