Users & roles

Organization membership is tenant-isolated. Institution administrators can change operational roles; self-role changes are blocked to reduce lockout risk.