Roles & access
Who on the account may send, approve, or export — not API key rotation hygiene.
Who may send vs API key rotation hygiene
People roles decide who may send. API key rotation and sandbox cutover stay under Developers — do not merge seat grants with secret lifecycle.
Who may send, approve, or export
Split send, approve, and export so finance month-end CSV cannot fire production SMS. Bind Live promotion to runway and compliance gates.
An export role must not send
Least privilege on prepaid: audit and GDPR export access is not a campaign send seat. Keep report roles read-only on the live messaging path.