Keep membership tight, explicit, and easy to audit.

Role changes and deactivation flow through the admin API.