NK Team+ multi-user with fine-grained permissions. Essential for ops teams and managed hosting.
3-layer model
- User (el_user) — email + SRP + 2FA
- Group (el_user_group) — shared permissions
- Permissions (el_user_group_permission) — bitmap, each bit = one endpoint access
3 default group templates
- Operators (all sites/DBs/monitoring/logs/backups, no billing/user mgmt)
- Customers (only their own resources, no system services)
- Auditors (read-only everything)
vs OS isolation
multiuser is admin permissions (who can click what), user_iso is OS process isolation. Both independent and complementary. See User Isolation.