| Head of Security Operations | Everything in the module, approve publishing | Read whistleblower identities | Hardware key | 2 |
| SOC Analyst (L2) | Triage, contain, run hunts, open incidents | Change keys or policies | Passkey | 14 |
| Security Engineer | Policies, workflows, detections, integrations | Approve own changes | Passkey | 9 |
| Key Custodian | Key ceremonies and HSM approvals | Everything else | Hardware key + smart card | 5 |
| Internal Audit (read-only) | Read everything, export with proof | Change anything | Passkey | 3 |
| MLTFPD Director (oversight) | Approve Sev 1 actions, publish workflows | Day-to-day operations | Hardware key | 1 |