Roles
What each may do:
These are enforced by the server on every request. The console mirrors them by
hiding what a person cannot use, but the check that matters is the server’s.
A cardholder does not get the console at all. Handing someone whose whole
business here is the card in their pocket the full firm console would expose
work they cannot act on. They get a page for their own charges instead. See
expense claims.