Access Admin list: Owners and super admins; role changes, branch scope (for managers), last owner protection. Manager capabilities: e.g. “Can managers approve their own timesheets?” toggles.
