Hi, we have a basic commercial network that apart from having admins, nodes and clients, we need to have users (individual citizens) that transact on the network. The problem is that we need to give users a role that is not client, because this is nota scalable solution and won't be a sustainable infrastructure for future additions. We need to implement this for various reasons, one of them being that users should only be able to invoke chaincode, and not have access to other resources like event registration.

Since Fabric does not allow for custom Node OUs, AFAIK we have 2 options:
 -- Create 2 Intermediate CAs to distinguish 2 departments, members, and users
 -- Use affiliations inside the CA and set Organizational Units inside  config.yaml and  

1st question: How would you approach this issue? Is there a 3rd way?
2nd question: How do we implement the 2nd option? There is limited documentation as to how this is achieved. I will present what I have tried but does not work.

On CA Config:
On config.yaml: