Admin Users
The people who can sign in to the admin app. The Admin Users screen and the server:admin-user commands, setup links, the default admin user root, resetting an admin user's credentials, and deleting one.
Second step and passkeys
How an admin user signs in. The password and the authenticator app, passkeys, going passwordless, the Password & Security page, and the server-wide rule that every admin user must use a second step.
Allowed addresses
An admin user's allowed IP addresses. What the list is checked against, how to set it on the Admin Users screen and with server:admin-user:set-allowed-ips, the refusal, and the two ways in that are not held to it.
Break-glass on the host
server:login, the sign-in token that root on the server mints for any admin user. When to use it, what it skips, what it leaves in the auth log, and the other host commands that get a locked-out admin user back in.
Auth Log
The one list of every sign-in, failed sign-in and credential change on the server, for domain users, accounts and admin users. Its filters, what a row holds, what is not recorded, who else sees which rows, and how long rows are kept.