Roles: admin, author, reader and demo

• Admin: every page, every setting.
• Author: writes and publishes their own posts, manages their author profile and API keys, and moderates comments.
• Reader: a public account for commenting; no admin access.
• Demo (read-only): sees every admin page an admin sees, with real data, but cannot save, publish, delete, send or run anything, and cannot download backups. A banner at the top of each page says so.

Admins change roles in Admin → Users. A role change or ban signs the person out straight away.