Roles

Assign one role per person in this environment. An Access Admin renews their own access before it expires. Expired access is not renewed automatically. Emergency recovery uses the bootstrap CLI.