Named staff accounts
Open Staff & permissions with staff.manage. Use separate named accounts and assign only the required Business/System capabilities. Roles include administrator, system, business, sales, billing and support; the effective permission determines access to a particular action. A System SMTP operator does not automatically need customer support or ledger mutation access.
Common capabilities include clients.view/manage, orders.view/create/cancel, services.view/manage, domains.view/manage, invoices.view, payments.view/record, catalogue.manage, support.view/manage, settings.manage, integrations.manage, email.manage, modules.manage, themes.manage, dns.manage, updates.manage, reports.view and system.diagnostics. The installed permission editor is authoritative for its release; do not infer additional powers from a menu label.
MFA, passkeys and trusted browsers
Use Account security to enrol the required authenticator and retain recovery codes privately. Staff passkeys use the configured canonical admin host/origin. A passkey enrolled for one hostname does not automatically work on a renamed domain. Review trusted browsers and revoke old registrations when a device is lost. Passkey sign-in is not permission to skip protected action confirmation.
Use Security activity to inspect current/recent sessions and revoke one or all other sessions. Password/team/access changes can invalidate sessions. A disabled account or expired product permission must not remain privileged merely because a browser tab was open.
Administrative address
Administration access configures the supported administrative path/host controls. Default examples use /admin/master. Hostname and prefix are routing choices, not replacements for authentication, MFA and permission checks. Preserve the actual .env, configured canonical host and recovery access before changing them.
Emergency local recovery
A verified installation operator can run interactive php artisan emaila:recover-access owner@example.invalid for an existing administrator. It requires local terminal access, explicit confirmation and a strong repeated password, resets MFA, invalidates sessions and records an audit event. It creates no new account and is not a public bypass. Never put the new password in command arguments or support chat; enrol MFA again immediately.