Give staff a smaller set of administrative actions
The separate, uncommitted Enrollment Manager worktree defines four permissions: list users, create users, list enrollments and create enrollments. It doesn't grant user or enrollment editing and deletion, course management, access management or administrative role assignment. The role-user controller remains Super Admin only.
The user controller enforces that distinction on the request. Without users manage access, it rejects role, access_roles and audience_ids, then supplies student-only access and the required Anyone audience. Hiding those fields in the interface isn't the protection; a forged request meets the same refusal.
The contact-edit path also preserves existing role and access flags when the actor lacks access-management permission, and skips audience synchronization. Updating ordinary account details therefore doesn't quietly rewrite privileges.
Keep migration behavior as narrow as the role
The migration uses idempotent inserts, refuses rollback while the role is assigned and preserves a pre-existing enrollment-delete permission. The tests cover permitted creation and enrollment, forged privilege fields, forbidden writes and rollback behavior.
The August report records 14 focused tests with 76 assertions and a passing full suite. Dependency-audit failures still blocked release. This remains local, uncommitted work; no account provisioning, staging or production migration, or release is established by this review.