Two factor is required for every role. Access is by invitation: an address with no matching active user is refused rather than created.