• Role-based permissions
  • Data isolation per user or team