- To create the internal instance (section 3): Admin role.
- For a team member to use it (section 4): their account must have two-factor verification (TOTP) on, same as for “Channel-linked access” — turn it on in Settings → Security (Manual 26, section 5) if you don’t have it yet.