Users and roles
Create Control users and assign the minimum role they need.
Administrators can create additional Control users from Access.
New accounts receive the supported first-login/temporary-password flow shown by Control. Give each person their own account instead of sharing an Administrator login.
Choose the least powerful role that still allows the person to do their work. Promote a user only when their responsibilities change, and disable or remove access promptly when it is no longer needed.
API tokens do not replace user-role administration; token capabilities remain limited by the token scope and account authority.