Operational access is separate from member accounts. All sensitive mutations are role-checked and audited.