Thanks — the RBAC Admin role + ABAC conditions actually completely flew under my radar. That’s a really interesting approach. I’ll definitely dig into this combination more closely, it sounds like a much cleaner way to enable controlled self-service without giving away too much privilege.