- IAM permissions.can_write defaults to false for all users - Our app controls writes via adminMode + company membership