Restricted platform access for Platform Admins, Ops & Support engineers.
Enforces SUPER_ADMIN, OPS, and SUPPORT permission tiers. Impersonation events are permanently logged in audit_events.