Role order: viewer < operator < lead < admin. Pre-provisioned users are adopted on their first Google sign-in — no invite email, just send them to the Hub. Client access = which dashboards they can edit (admins edit all). Minted MCP keys inherit the chosen role and are shown once with setup instructions. SOP-level access is set per-document inside the SOP browser. You can't change your own role or deactivate yourself.