Console administrators authorized by authoritative membership in the it-admins group. No browser-local role overlay is applied.