This first account can add, pause, and rotate access for everyone else.
Access is checked before pages and API routes load.