Idea 1: use login objects within Person to define user accounts explicitely and use custom read/write permissions and workflow.

Idea 2: use creator relation between any new document and Person instance. Provided that assignment is well historised and read only, all security info can be regenerated any time.

--

Another approach:

Use login objects within Person to define user accounts explicitely and use custom read/write permissions and workflow.

Allow for a single account to be provided to multiple users (so that if one leaves, another person can take over previous accounts)

Use Zope Owner role as the "driver" to define user based local roles.