Gold Layer + Semantic Model + Reporting - Security for TDA question

Dears,

I have a Microsoft Fabric Architecture (Medallion + Datamesh) as below (figure 1)

I have the TDA completed for layers till Silver. This was achieved with the excel help I got from our community

But I still have questions about the consumption part (Gold + Semantic + Reporting / Self-Service) from a security point of view

May I kindly ask for your help? please

Figure 1: 

Summary ,

Gold layer : is divided by workspaces, each workspace representing a data domain. Each workspace will have one or more lakehouses

Semantic model : There is a semantic model inside each workspace using a direct lake method to secure that one semantic model can fetch data from the lakehouses in the workspace where it is, but also, from lakehouses from other workspaces for the sake of re-usability

PBI Reports : We will have powerbi dashboards and several different operational reports

Excel : There will be the possibility of doing Self-service via Excel and via PowerBI

SElf-Service - Possibility of doing Self-Service via PBI or Excel

4 types of Personas and their ability:

All users : Will be able to connect to powerBI and see the reports

Power Users : Will be able to do what All users can do, plus, create as well PBI new reports against our semantic model and create measures in the existing semantic model

Advanced users : Able to do what Power Users can do plus, add new tables to the semantic model which exist in gold layer and Use excel and PBI do do had-hoc reports against our semantic models (Self-service)

Master Users : Able to do what Advanced users can do, plus going directly to our gold layer to make selects to tables

Note - Some of this users are not in our tenant

Questions:

Group All Users :

1) Was thinking in creating this four Entra-ID groups (the groups will not have this names, their true names will be different) and for the users which are external (do not belong to our tenant), bring them into our Entra-ID (B2B) as external users and join them to this Entra groups

2) Create a fixed identity, which will be used by semantic model to connect to gold layer workspaces, than, on top of it, create RLS at semantic level. This way we don't have to provide permissions to all users in our Gold layer. Its the fixed identity which will hold the permissions to our gold

3) I don't know where this fixed identity is created nor if its created via the onelake security new functionality or if its  a workspace identity tjhat I create . How do I create this fixed identity is through the new funcionality called onelake security?  I see it here :  Fixed Identity and RLS in Microsoft Fabric Direct Lake Semantic Model

4) The RLS at semantic model level is created by the new functionality called Onelake security?

For all the other 3 Gorups what would you propose as security models?

1 - For example, can I have excel self-service and powerBI self -service?

2 - What should I propose as security model for this 3 other gorups?

Also, important, can someone please help understand, per user group , what is the security at rest, security in transit and service-to-service security that I can use to explain in my technical desgin authority document (TDA)?

Thank you very much for all the support

Best regards,

Pedro

And can someone please explain me what shall I put in the TDA for security in transit , service-to-service and security at rest for this (gold + semantic + Reporting)

Thanks a lot,

Pedro