Most teams build the customer interface first and hang the admin console off it as an afterthought. Then the first real incident arrives — a chargeback, an abusive account, a broken balance — and the person on call is clicking through a page that was never designed for a bad day.
Start with roles. Decide who can read, who can block, who can move money-adjacent numbers, and who can change the other roles. Environment allowlists are the blunt, reliable fallback; stored roles let you grow a team without a redeploy. Whichever you choose, resolve the effective role on every request, inside the transaction that performs the write — authority should never be stale.
Every write should demand a reason and leave an audit row. Not for compliance theater, but for tomorrow, when someone asks who blocked that account and why, and the answer needs to already exist. Reasons also force the operator to articulate intent, which quietly prevents a surprising share of mistakes.
Keep the verbs narrow and explainable. Blocking revokes sessions but does not cancel billing; credit adjustments never charge or refund; role changes cannot touch your own account; protected staff accounts cannot be blocked at all. A console of small, auditable actions beats a god-mode panel every time, because it fails in ways you can describe.