Authorized staff only · every action is audit-logged