Admin, Manager, and Standard User — each with clearly scoped access.