Admin only
Admin access will be enforced by a server-side role check (never client storage) once the cloud backend is connected.