Controlled access

Return to the route.

Operational roles see only their permitted surface. Privileged roles complete a time-based second factor.

1. Password validation
2. Role-aware second factor
3. Rotated authenticated session