Thank you for the details. Yes, I agree we should adopt the DABs for the deployment and define the resources while creating the app ( which can be consider as as solution). However if the permission module is managed separately, lets say via terraform, it is better to separate the app creation and permission module separately for easy management. When we create the app, the sp will created and attach to that app. Subsequent changes may happen to code only.