With explicit claim-to-role mapping and step-up assurance (acr), groups: ["meridian-flight-directors"] and acr: "urn:chronos:aal3-fido2" grant write access. With acr: "aal2" or only ["meridian-all-staff"], the Relying Party accepts their identity (200 OK for read-only status views) but returns 403 Forbidden or a step-up authentication challenge before any administrative action.