{"file":"docs/seed/Owners.txt","start":1,"end":24,"lines":[{"number":1,"text":"System Admin Owner"},{"number":2,"text":""},{"number":3,"text":"The first Owner has:"},{"number":4,"text":""},{"number":5,"text":"owner_scope = system"},{"number":6,"text":""},{"number":7,"text":"It can:"},{"number":8,"text":""},{"number":9,"text":"Create gift Owner accounts."},{"number":10,"text":"Activate manually paid Owner accounts."},{"number":11,"text":"Suspend Owner accounts."},{"number":12,"text":"Enter a tenancy oversight view."},{"number":13,"text":"Review system alerts."},{"number":14,"text":"Review all public key and audit information."},{"number":15,"text":""},{"number":16,"text":"Entering another tenant should require:"},{"number":17,"text":""},{"number":18,"text":"Step-up authentication."},{"number":19,"text":"A reason."},{"number":20,"text":"A visibly different UI state."},{"number":21,"text":"A mandatory event record."},{"number":22,"text":"A short oversight-session expiry."},{"number":23,"text":""},{"number":24,"text":"The System Admin Owner can inspect server-held information but cannot impersonate an Author because CRE8 does not possess Author private keys."}]}