Users, routing policy overrides, the Class-C egress log, feature flags, and backend health. Write actions require an admin role.