Use persisted self-hosted roles and the isolated admin origin so authorized staging accounts can discover the protected admin surface.