How do we secure access for hybrid teams (SSO + roles)?