Administrative access baseline with password login, tenant isolation, and explicit active-company context.