Authorization

Add narrowly scoped account-management authority without handing a service role every power carried by an administrator permission.