Administrator accounts: dynamic roles vs admin role profiles, API and CLI permissions

Every person or system that manages the firewall should have its own administrator account with the least privilege needed. Shared accounts make it impossible to tell who changed what, and over-privileged accounts turn one stolen password into a full compromise. Accounts are created under Device > Administrators, and each account has an authentication method and an administrative role. The role decides what the account can see and change in the web interface, the command-line interface (CLI) and the APIs.