Credentialed access.

Access is role-scoped. Agency admins hold the full mandate, compliance officers mint and attest, viewers observe.