Restricted administration

Operations require separate clearance.

This authentication boundary is independent from client access. Successful and failed attempts are tracked, sessions can be revoked, and privileged actions enter the audit ledger.