Restricted operations workspace. Accounts require administrator-assigned roles; self-registration does not grant internal access.
Roles are provisioned by an S1 administrator after account creation.