INDEPENDENT OPERATIONS BOUNDARY

Authority before operations.

This surface validates an explicit staff principal. A Marketplace account, role or email domain never grants Admin access.