Every login on a BOA account is a key of one kind, and the ring holds six of them: your own panel login and your oN.ftp shell open everything; a colleague's login to the Ægir panel holds one of two roles, Client, which can do with a site what you can short of deleting it, backups and the admin login link included, or the new Site operator, the valet key of the control panel, which verifies, clones, migrates, flushes caches and runs updates on the Client's Drupal and Backdrop sites and cannot reach a copy of the database, the admin account or the delete button, not even from the Backups tab; and a colleague's shell login comes as one of two, files and themes, or whole codebases with Composer and Drush. Every task records the login which queued it. Drush is the database, so the codebase key belongs with the Client role and never beside a site operator, and the roles are a list shipped with BOA, re-asserted every night, readable to the permission on one page.