Admin access required — role changes are logged to the audit trail.