Staff, roles and least-privilege access

Administrator accounts are MFA-protected. Sensitive changes require fresh MFA and are written to the audit trail.